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articles  about  the  2004  Madrid  bombings.  The  Baseline  model  is  further  compared  with 
two  different  representations  of  the  same  terrorist  group:  1)  the  Expert  model,  which  is 
identical  to  the  Baseline  model  except  for  the  fact  that  the  actors  have  high  application 
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Baseline  but  with  a  hierarchical  structure.  All  models  are  tested  under  both  baseline  and 
high  counterterrorist  conditions.  This  thesis  examines  how  different  contingency  factors 
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I.  INTRODUCTION 


One  of  the  premier  issues  facing  governments  today  is  terrorist  networks.  These 
networks  must  be  understood  in  order  to  apply  effective  policies  and  practices  to 
safeguard  citizens,  assets,  and  interests.  For  decades,  terrorist  cells  have  relied  on  the 
support  provided  by  structured  organizations  like  A1  Qaeda  for  their  funding,  planning 
and  execution  of  attacks  (Benjamin  &  Simon,  2005).  However,  recent  large-scale  terrorist 
acts,  like  the  Madrid  bombings  in  2004  or  the  London  bombings  in  2005,  strengthen  the 
view  that  terrorist  cells  operate  in  a  self-organized  manner  (Benjamin  &  Simon,  2005; 
Bell,  2002). 

On  Thursday,  March  11,  2004  at  0639  GMT,  within  a  three-minute  time  frame, 
ten  bombs  exploded  on  four  trains  in  three  stations  in  Madrid,  Spain  (BBC  News,  March 
12,  2004).  This  attack  killed  191  people  and  wounded  1800  more  (Jordan  &  Wesley, 
2006).  The  attack  occurred  three  days  before  the  general  elections.  Euskadi  Ta 
Askatasuna  (ETA),  a  terrorist  group  that  has  performed  many  terrorist  attacks  on  Spanish 
soil  since  it  was  founded  in  1959,  was  blamed  by  the  Popular  Party’s  Prime  Minister  Jose 
Maria  Aznar  for  being  responsible  for  these  attacks,  even  though  early  findings  suggested 
that  ETA’s  “methods”  did  not  match  with  those  used  by  the  terrorists  who  had  performed 
the  2004  Madrid  bombings. 

After  a  few  days,  it  became  clear  from  the  emerging  evidence  that  a  Jihadi 
terrorist  group  was  responsible  for  the  attacks  (Benjamin  &  Simon,  2005;  Wright,  2004). 
The  Spaniards  were  angry  with  the  Popular  Party,  both  for  insisting  that  ETA  was 
involved  in  the  attacks  and  for  sending  Spanish  troops  to  Iraq  despite  the  public’s 
negative  opinion  of  this  act.  The  terrorists  who  had  performed  the  attacks  demanded  the 
removal  of  Spanish  troops  from  Iraq.  The  Socialist  Party,  which  had  been  promising  the 
removal  of  troops  from  Iraq  in  its  recent  campaign,  was  elected  at  the  general  elections 
on  March  14,  2004,  and  Spain  withdrew  its  troops  from  Iraq  (Benjamin  &  Simon,  2005). 
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Many  academics  and  practitioners  have  suggested  counterterrorist  policies  that 
could  be  adopted  by  governments.  Bell  (2002)  writes  that  thwarting  terrorism  requires  a 
policy  that  focuses  on  the  idea  that,  because  terrorism  relies  on  commitment,  “loss  of 
faith,  the  imposition  of  reality,  and  changing  times  can  erode  its  strength.”  Changes  in  the 
Islamic  population’s  ideological  and  cultural  beliefs  about  Western  culture  may  diminish 
the  motivation  of  people  to  join  terrorist  groups.  This  change  of  ideology  may  be 
achieved  by  developing  a  higher  standard  of  living  in  regions  that  “generate”  terrorists 
(Brafman  &  Beckstrom,  2006). 

Loss  of  faith  and  imposition  of  reality  are  two  issues  that  require  time.  The  near 
term  issue  that  arises  is  how  terrorist  networks  can  be  understood  and  more  effectively 
thwarted  until  Bell’s  policy  reaches  its  goal? 

Network  theory,  a  branch  of  complexity  theory,  tries  to  explain  the  various  types 
of  systems  that  emerge  in  the  real  world.  It  is  based  on  mathematical  graph  theory. 
Networks  can  be  divided  into  four  components:  social  (among  people  or  groups  of 
people),  information  or  knowledge  (such  as  the  network  of  citations  among  academic 
papers),  technological  (such  as  the  electric  power  grid)  and  biological  (such  as  DNA) 
(Newman,  2003). 

In  order  to  understand  terrorist  networks,  many  analysts  use  the  Social  Network 
Analysis  approach  (Hassan,  2007;  Mccartan  et  al.,  2008;  Magouirk  et  al.,  2008;  Jordan  et 
ah,  2008).  Social  Network  Analysis  examines  the  connections  and  interactions  among 
individuals  or  groups  based  on  common  patterns  of  friendship,  occupation,  ethnicity,  or 
any  other  pattern  that  is  of  interest  to  the  researcher  (Newman,  2003).  Hence,  terrorist 
networks  are  analyzed  in  tenns  of  variables  such  as  strong  and  weak  ties,  and  density 
among  the  participants  or  groups  that  constitute  the  network. 

Traditional  social  network  studies  often  have  been  criticized  for  inaccuracy  and 
subjectivity  (Newman,  2003).  Even  though  many  of  these  studies  follow  a  backwards 
approach  (Burton,  2003)  after  the  events  under  examination  have  occurred  (Hassan  2007; 
Mccartan  et  al.,  2008;  Jordan  et  al.,  2008),  the  created  networks  may  be  inaccurate 
because  of  vital  data  missing  from  the  researcher’s  database.  The  reasons  for  this  missing 
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data  could  be  because  some  information  was  confidential,  some  information  never  was 
publicly  released,  or  because  the  network  included  participants  who  were  not  considered 
to  be  a  part  of  this  network.  Of  course,  many  social  network  analysis  papers  take  these 
considerations  into  account  (Mccartan  et  ah,  2008;  Jordan  et  ah,  2008).  Moreover,  Social 
Network  Analysis  does  not  examine  the  structure  or  the  workflow  of  a  network  for 
specific  activities  (e.g.,  a  bombing  attack)  or  the  types  of  interdependencies  (pooled, 
sequential,  and  reciprocal  (Thompson,  1967)  that  exist  among  the  tasks. 

According  to  Simon  (1993)  and  Epstein  (1999),  emerging  virtual  environments 
based  on  computational  models  can  imitate  actions  and  behaviors  observed  in  the  real 
world.  It  must  be  kept  in  mind  that  “we  do  not  have  to  know,  or  guess  at,  all  the  internal 
structure  of  the  system  but  only  that  of  it  that  is  crucial  to  the  abstraction”  (Simon,  1996). 
Conceptual  Simulation  Models  have  been  used  to  represent  terrorist  networks  as  a 
business  process  and  provide  insights  to  counterterrorism  policy  makers  (Nissen  & 
Leweling,  2007).  These  computer-based  models  analyze  terrorist  networks  primarily 
through  the  lens  of  contingency  theory  using  Agent  Based  Modeling  techniques. 

The  examination  of  terrorist  networks  from  an  organizational  point  of  view  has 
been  criticized  because  terrorist  networks  cannot  be  seen  as  a  part  of  a  larger  terrorist 
network;  they  operate  in  a  self-organizing  way  and  the  network’s  participants  constantly 
change  (Bell,  2002;  Benjamin  &  Simon,  2005).  However,  locally  autonomous  terrorist 
groups  that  are  task  oriented  meet  Galbraith’s  (1977)  definition  of  organization:  they  are 
composed  of  groups  of  people  in  order  to  achieve  their  purpose  (the  terrorist  attack) 
through  a  division  of  labor  among  the  network’s  participants.  These  groups  are  integrated 
by  information-based  decision  processes  that  are  continuously  performed  by  the 
network’s  participants.  Sequential  tasks  are  performed  as  in  a  typical  assembly  line.  The 
output  of  task  A  is  the  input  of  task  B,  where  task  A  is  B’s  preceding  task.  Although  task 
B  depends  on  task  A,  task  A  is  not  dependent  on  task  B.  Reciprocally  interdependent 
tasks  are  performed  together,  and  the  output  of  a  task  becomes  the  input  of  another  task 
and  vice  versa  (Thompson,  1967).  For  example,  a  terrorist  attack  can  be  divided  into 
distinct  sequential  tasks  (e.g.,  plan,  finance,  assemble  the  explosives,  train,  and  execute) 
but  some  tasks  are  also  reciprocally  interdependent  (e.g.,  the  planning  and  financing 
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phases  of  a  terrorist  attack,  after  a  certain  point,  are  perfonned  together  and  a  change  of 
the  output  of  one  task  directly  affects  the  input  of  the  other).  Bell’s  (2002)  view  of  locally 
autonomous  terrorist  networks  works  in  organization  theory  because  “organizations  seek 
to  place  reciprocally  interdependent  positions  tangent  to  one  another,  in  common  group 
which  is  (a)  local  and  (b)  conditionally  autonomous”  (Thompson,  1967). 

Tasks  that  require  reciprocal  interdependence  need  to  be  coordinated  mutually  by 
the  participating  members.  The  required  amount  of  coordination  among  the  members  of 
terrorist  networks  is  largely  due  to  the  low  level  of  experience  among  their  members  (the 
Madrid  terrorist  cell)  and  the  complexity  involved  in  performing  a  terrorist  act  under 
secrecy.  As  a  result,  the  members  of  terrorist  networks  rely  on  project  grouping  to 
accomplish  the  required  coordination  (Thompson,  1967). 

This  thesis  examines  the  structure  and  attributes  of  the  terrorist  network 
responsible  for  the  bombing  attack  that  occurred  in  Madrid  on  March  11,  2004.  The 
intent  is  to  represent  the  terrorist  network  responsible  for  the  Madrid  Attack  and  examine 
the  key  attributes  of  this  network.  Emphasis  is  placed  on  the  actors’  roles,  which  will  be 
examined  with  the  use  of  computer  simulation.  The  data  set  is  drawn  from  many 
academic  papers  and  news  articles  that  analyze  or  describe  this  specific  event.  This  thesis 
focuses  on  the  exploration  of  the  structural  and  task  dynamics  of  the  network  using  Agent 
Based  Modeling  (Epstein  &  Axtell,  1996;  Miller  &  Page,  2007).  The  research  question  is: 
How  do  different  contingency  factors  affect  the  preparation  and  execution  of  a  terrorist 
bombing  attack?  These  contingency  factors  are  the  structural  configuration  of  the  terrorist 
network,  the  environmental  ambiguity  and  complexity,  and  the  members’  skill  level.  The 
selection  of  the  case  study  approach  is  based  on  the  research  question.  According  to  Yin 
(2002),  a  case  study  is  appropriate  when  “a  ‘how’  or  a  ‘why’  question  is  been  asked 
about  a  contemporary  set  of  events,  over  which  the  investigator  has  little  or  no  control.” 

This  thesis  produces  a  computational  model  using  Agent  Based  Modeling 
software  POW-ER  v.3.5b,  which  imitates  the  structure  and  the  workflow  of  the  terrorist 
network  before  the  attack  (Baseline  model).  A  cross  comparison  of  the  generated 
computer  model  with  Social  Network  Analysis  representations  that  describe  the  Madrid 

attack  and  the  existing  datasets  is  made  in  order  to  evaluate  the  validity  of  the  model. 
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Hence,  keeping  a  balanced  level  of  realism  in  the  construction  of  the  computational 
model,  this  thesis  examines  and  analyzes  the  process  of  the  Madrid  terrorist  attack, 
suggesting  counterterrorism  policies. 

Sensitivity  analysis  of  the  computational  model  can  identify  those  “parameters 
and  relationships  to  which  the  behavior  and  policy  recommendations  are  sensitive” 
(Sterman,  2000).  According  to  Galbraith  (1977),  a  low  level  of  formalization  can  handle 
high  uncertainty.  In  addition,  experienced  workers  produce  fewer  exceptions  than 
inexperienced  ones  in  unstable  environments.  The  Madrid  terrorist  network  had  low 
formalization  and  centralization  (Benjamin  &  Simon,  2005)  and  the  members’  skill  level 
was  low.  According  to  Haahr-Escolano  (2005),  the  members  of  the  2004  Madrid  cell 
were  “amateurs.”  In  addition,  the  Madrid  network  was  highly  decentralized  (Benjamin  & 
Simon,  2005).  Galbraith  (1977)  proposed  that,  when  the  tasks  performed  by  a 
hierarchical  organization  become  complex  and  unpredictable,  then  senior  managers  are 
overloaded  with  exceptions.  An  exception  occurs  when  there  is  lack  of  information  at  the 
responsible  node  to  accomplish  a  task.  Therefore,  this  thesis  compares  the  Baseline 
model  with  both  an  “Expert”  model,  which  is  the  same  as  the  baseline  model  with  the 
difference  that  its  members  have  high  skill  and  application  experience  levels,  and  with  a 
“Hierarchical”  model,  which  was  built  based  on  the  Baseline  model,  under  different 
counterterrorist  environments.  According  to  Burton  &  Obel  (1995),  computational 
models  can  be  used  to  examine  “what  is,”  “what  if,”  and  “what  should  be”  questions. 
This  thesis  initially  examines  the  “what  is”  question  with  the  baseline  model  based  on 
archival  data  about  the  2004  Madrid  bombings,  and  afterward  compares  the  Baseline 
model  with  the  two  other  hypothetical  models  in  order  to  test  the  “what  if’  question.  This 
approach  is  used  in  order  to  examine  how  different  contingency  factors  affect  the 
preparation  and  execution  of  a  terrorist  bombing  attack,  which  is  the  research  question  of 
this  thesis.  The  results  of  these  comparisons  also  suggest  potential  policies  and  actions 
that  could  slow  down  or  disrupt  terrorist  networks.  This  thesis  also  shows  how  a 
computational  modeling  technique  like  Agent  Based  Modeling  is  able  to  examine 
specific  terrorist  attacks,  and  provide  counterterrorist  recommendations  using  real  world 
data. 
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The  second  chapter  covers  the  theoretical  background  on  Network  Theory, 
Organization  Design,  and  Computer  Simulation.  The  next  chapter  covers  the  case  study 
of  the  2004  Madrid  bombings.  The  fourth  chapter  covers  the  research  design  of  the  thesis. 
The  fifth  chapter  has  the  results  of  the  various  simulations  and  comparative  presentations 
of  the  findings.  The  last  chapter  covers  the  findings,  the  limitations  of  this  thesis, 
suggests  counterterrorism  policies,  and  indicates  potential  venues  for  future  research. 
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II.  BACKGROUND 


This  section  initially  examines  terrorism  in  general,  and  it  covers  some  additional 
background  about  the  way  it  is  viewed  in  the  information  age.  Then  it  analyzes  the  Social 
Network  Analysis  (SNA)  technique  that  is  used  by  scholars  and  practitioners  in  order  to 
analyze  terrorist  networks.  SNA  is  a  branch  of  network  theory  that  has  its  roots  in  graph 
theory  from  mathematics,  so  a  brief  description  of  network  theory  also  is  provided.  The 
purpose  of  this  thesis  is  to  examine  the  process  and  the  contingency  factors  that  affect  the 
development  of  a  terrorist  bombing  “project,”  using  existing  data  from  the  March  11, 
2004  Madrid  bombings.  This  examination  is  performed  with  the  use  of  computational 
models,  so  a  brief  description  of  computational  organization  theory  is  provided. 

A.  TERRORISM  AS  A  FORM  OF  WARFARE  IN  THE  INFORMATION  AGE 

Many  scholars  have  defined  terrorism,  and  its  definition  has  been  a  point  of 
contention  within  academia.  The  difficulty  with  terrorism  is  that,  even  though  it  is  an 
“ism”  (like  communism,  capitalism  or  even  postmodernism),  it  does  not  represent  an 
ideological,  political  or  cultural  category.  Terrorism  is  a  tactic  where  fear  is  the  dominant 
key  element.  Other  key  elements  of  terrorism  are  the  use  of  violence,  the  symbolic  use  of 
victims,  the  absence  of  moral  constraint,  advanced  planning  and  operational  seriality 
(Robb,  2007). 

Terrorism  is  a  tactic,  and  tactics  are  parts  of  warfare.  According  to  Robb  (2007), 
there  are  four  generations  of  warfare.  The  first  two  generations  of  warfare  (Mass  and 
Industrial)  are  considered  as  conventional  warfare,  and  the  second  two  generations 
(Blitzkrieg  &  Guerilla)  as  unconventional  warfare.  Conventional  warfare  is  the  type  of 
warfare  that  is  fought  between  nations,  where  the  conflict  takes  place  among  well- 
structured  annies  following  tactics  and  procedures.  In  conventional  warfare,  annies 
traditionally  target  only  what  is  of  military  interest.  In  contrast  to  conventional  warfare, 
unconventional  warfare  uses  indirect  opposition  tactics  and  is  based  on  surprise  and  low 
intensity  conflicts.  In  unconventional  warfare,  civilians  and  noncombatant  infrastructures 
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may  be  targeted  on  purpose  by  the  opposing  groups.  A  commonly  used  method  is  the 
“system  disruption  method,”  which  is  a  simple  way  of  attacking  the  critical  networks 
(electricity,  oil,  gas,  water  and  communications)  that  underpin  social  life. 

Terrorism  could  fit  in  the  fourth  generation  of  warfare  (guerilla  warfare),  since  it 
has  many  elements  in  common.  On  the  other  hand,  terrorism  has  some  critical  differences 
with  guerilla  warfare  that  make  it  distinct.  Guerillas  use  terror  to  influence  the 
noncombatant  population,  and  their  tactics  are  similar  to  the  ones  used  by  terrorists.  The 
differences  with  guerilla  warfare  are  the  following:  (a)  terrorist  groups  operate  globally 
and  are  not  limited  within  the  borders  of  a  particular  country  like  guerillas;  and  (b)  a 
guerrilla  tries  to  destabilize  a  particular  state,  but  terrorism  has  as  a  goal  to  destabilize  a 
series  of  countries,  mainly  the  Western  ones  (Wright,  2004).  In  addition,  terrorism 
operates  in  both  the  physical  and  information  domain,  while  guerillas  operate  mainly  in 
the  physical  domain  (Robb,  2007).  Hence,  terrorism  is  a  distinct  form  of  warfare. 
Therefore,  like  any  “age,”  the  information  age  has  its  own  form  of  war  (Arquilla,  1996). 

A1  Qaeda  (AQ)  is  the  largest  terrorist  organization  with  multiple  cells  and 
affiliates  in  existence  and  has  been  responsible  for  major  terrorist  attacks  (New  York, 
2001,  Bali,  2002,  Madrid,  2004,  London,  2005).  It  was  founded  after  the  Soviet  invasion 
of  Afghanistan  as  an  anti-Soviet  resistance  organization.  At  that  time,  it  was  an  anny  of 
Arab  warriors  who  entered  the  war  in  order  to  help  the  Afghans  fight  the  Soviets,  and  it 
was  known  to  the  world  as  the  anti-Soviet  jihad  (Napoleoni,  2005). 

There  are  two  kinds  of  jihad:  defensive  and  offensive.  The  defensive  jihad  is 
about  taking  up  anns  in  order  to  protect  Islam,  and  the  offensive  one  is  about  taking  up 
arms  for  spreading  Islam.  In  order  to  perform  offensive  jihad,  the  emir  or  caliph  of  the 
community  should  call  for  arms  and  it  is  then  the  duty  of  all  Muslims  to  join  him.  Osama 
Bin  Laden  and  other  leaders  of  Islamic  organizations  like  A1  Zarqawi  (Napoleoni,  2005) 
took  the  emir’s  role  in  A1  Qaeda.  Blind  terrorist  hits  have  been  made  in  the  name  of  jihad, 
including  the  March  11,  2004  Madrid  bombing  attacks  (Wright,  2004;  Benjamin  & 
Simon,  2005). 
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After  the  Soviets  left  Afghanistan  in  1989,  AQ  remained  active,  and  was 
transfonned  into  a  terrorist  organization.  The  anti-Soviet  jihad  was  transformed  by  its 
leaders  into  an  anti-colonization  jihad.  The  organization  configuration  of  A1  Qaeda  in  the 
late  1990s  was  bureaucratic  (Mintzberg,  1980),  and  was  commonly  referred  to  as  a 
hierarchy  (Benjamin  &  Simon,  2005).  The  organization  was  established  in  Afghanistan 
and  had  its  training  camps  across  the  country.  A1  Qaeda’s  leader  was  Osama  Bin  Laden, 
and  beneath  him,  there  was  a  clear  hierarchical  structure. 

After  9/11  and  the  beginnings  of  the  wars  in  Afghanistan  and  Iraq,  AQ 
decentralized  and  its  cells  were  spread  across  the  world,  enforcing  the  existing  ones  or 
creating  new  ones.  AQ  is  a  network  of  networks.  Small  terrorist  organizations  that 
operate  in  various  countries  are  interconnected  into  a  larger  network  that  forms  the  A1 
Qaeda  organization  (Benjamin  &  Simon,  2005). The  structure  of  this  terrorist  network  is 
not  hierarchical  or  close  to  any  of  Mintzberg’s  organizational  configurations  (Bell,  2002). 
A1  Qaeda’s  new  organizational  configuration  can  be  characterized  as  an  Edge 
organization  (Alberts  &  Hayes,  2003).  The  A1  Qaeda  network  contains  decentralized 
teams  that  operate  within  complex  environments  with  great  agility  and  adapt  to  the 
emerging  interchanging  conditions.  The  leader  of  A1  Qaeda  is  still  Osama  Bin  Laden,  but 
his  role  is  more  ideological  and  is  accomplished  by  spreading  videos  and  declarations;  he 
has  no  managerial  role  in  coordinating  the  existing  terrorist  branches  of  A1  Qaeda 
(Wright,  2004;  Wiemann,  2006). 

According  to  Robb  (2006),  each  state’s  goal  is  to  control  the  economy,  resources, 
laws,  infrastructure,  education  and  health  of  its  citizens.  Terrorists’  desire  is  a  failed  state. 
They  believe  that,  if  the  state  fails,  they  win.  Moreover,  technology  is  advancing  rapidly, 
providing  power  to  non-state  actors,  and  this  growth  strengthens  the  ability  of  groups  to 
use  decentralized  technological  tools  in  order  to  attack  a  state.  The  Global  War  on  Terror 
(GWOT)  is  a  decentralized  war  where  small  groups  have  a  dominant  role. 

B.  NETWORK  THEORY  AND  SOCIAL  NETWORKS 

In  order  to  thwart  terrorism  groups,  many  researchers  and  practitioners  analyze 
the  structure  of  terrorist  networks  using  Social  Network  Analysis  (SNA),  a  technique  that 
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is  based  on  network  theory  (Magouirk  et  al.,  2008;  Jordan  et  al,  2008).  SNA  deals  with 
the  analysis  of  the  structure  of  social  networks.  A  network  is  a  set  of  nodes  that  are 
interconnected  in  a  specific  way  with  links.  Links  represent  a  relation  between  two  nodes 
that  is  based  on  some  common  characteristic  (Newman,  2003).  For  example,  links  in 
social  networks  can  be  family  relations,  friendship  ties  or  education  ties.  As  was 
mentioned  in  Chapter  I,  networks  can  be  divided  into  social  (among  people  or  groups  of 
people),  information  or  knowledge  (such  as  the  network  of  citations  among  academic 
papers),  technological  (such  as  the  electric  power  grid)  and  biological  networks  (such  as 
DNA)  (Newman,  2003). 

Network  theory  suggests  three  main  categories  of  networks  based  on  their 
behavior  and  structure.  Random  networks  are  the  networks  that  are  created  by  luck  rather 
than  design  (Atkinson  &  Moffat,  2005).  Scale  free  networks  are  networks,  like  the 
internet,  where  the  hubs  (nodes  with  a  large  number  of  links)  are  more  likely  to  attract 
new  nodes  than  the  nodes  with  fewer  links  (Newman,  2003).  These  networks  seem  to 
follow  the  80/20  rule,  which  indicates  that  80  %  of  the  network’s  total  number  of  links 
are  connected  to  a  small  number  of  nodes  (Barabasi,  2002).  Small  world  networks  are  the 
networks  where  each  node  is  connected  with  any  other  node  in  the  network  by  a  short 
path  (Newman,  2003).  The  difference  between  random  and  small  world  networks  is  that 
the  average  path  length  (the  average  distance  between  a  random  pair  of  nodes)  is  smaller, 
and  the  clustering  coefficient  (how  tightly  the  nodes  are  interconnected  locally)  is  higher 
in  small  world  networks  (Atkinson  &  Moffat,  2005). 

Granovetter  (1973)  suggested  the  existence  of  strong  and  weak  ties  within  social 
networks.  Strong  ties  create  small  worlds  (clutters  of  nodes  highly  interconnected),  and 
weak  ties  are  the  “bridges”  among  various  small  worlds.  A  study  conducted  by  Milgram 
and  Travers  in  1969  was  the  first  experimentation  on  social  small  world  networks.  The 
researchers  asked  300  residents  of  Nebraska,  USA  to  send  a  letter  to  a  person  who  lived 
in  Boston,  Massachusetts,  USA  by  way  of  acquaintances.  A  sender’s  friend  was  regarded 
as  a  first  degree  of  separation,  a  friend’s  friend  as  a  second  and  so  on.  This  experiment 
showed  that  there  were  about  six  degrees  of  separation  on  average  between  the  senders 
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and  the  recipient,  meaning  that  there  was  a  short  path  connecting  every  pair.  This  study 
has  been  repeated  with  instant  messages  with  millions  of  participants  in  2008  and  showed 
results  similar  to  Milgram’s  study  (Yahoo  News,  August  4,  2008). 

Social  Network  Analysis  analyzes  real  world  social  networks  based  on  the 
concept  of  small  worlds.  This  technique  examines  the  connections  and  interactions 
among  individuals  or  groups  based  on  common  patterns  of  friendship,  occupation, 
ethnicity,  or  any  other  pattern  that  is  of  interest  to  the  researcher  (Newman,  2003).  The 
Social  Network  Analysis  approach  has  been  used  for  the  study  of  terrorist  networks 
(Hassan,  2007;  Mccartan  et  al.,  2008;  Magouirk  et  ah,  2008;  Jordan  et  ah,  2008).  Hence, 
terrorist  networks  are  analyzed  in  terms  of  variables  like  centrality  (a  high  number  of 
links  constitute  a  central  node  or  hub),  path  length  (the  average  distance  between  a 
random  couple  of  nodes)  and  the  clustering  coefficient  (how  tightly  the  nodes  are 
interconnected  locally). 

Most  academic  papers  that  use  SNA  to  examine  terrorist  networks  focus  on  case 
studies  that  examine  specific  terrorist  events,  or  explore  the  evolution  of  a  terrorist 
network  using  archival  data.  In  order  to  perform  this  analysis,  the  researcher  ideally  is 
fully  aware  of  the  participants  of  the  network  and  their  in-between  relations.  However, 
the  researcher’s  dataset  might  miss  vital  information  due  to  the  existence  of  classified 
information  or  due  to  incomplete  awareness  of  the  complete  network.  Traditional  social 
network  studies  have  often  been  criticized  for  inaccuracy  and  subjectivity  for  the  reasons 
mentioned  above  (Newman,  2003).  Another  limitation  of  SNA  is  that  it  focuses  mainly 
on  the  participants  and  their  connections,  and  not  on  the  process  participants  perform 
their  assigned  tasks. 

C.  THE  ORGANIZATIONAL  VIEW  OF  TERRORIST  NETWORKS 

According  to  Benjamin  &  Simon  (2005)  and  Bell  (2002),  terrorist  cells  cannot  be 
seen  as  a  part  of  a  larger  terrorist  network  like  Al  Qaeda  because  they  operate  locally  and 
autonomously  and  the  network’s  participants  constantly  change.  In  order  to  approach 
terrorist  cells  from  an  organizational  view  point,  the  locally  autonomous  terrorist  cell  can 
be  considered  as  an  organization  for  a  short  period  of  time  when  the  examined  network 
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performs  a  specific  project  (i.e.,  executes  an  attack).  This  approach  examines  terrorist 
cells  at  the  group  level  of  analysis  for  a  short  period  of  time,  minimizing  the  fluidal 
participation  that  occurs  within  terrorist  networks. 

According  to  Galbraith  (1977),  “organizations  are  1)  composed  of  people  and 
groups  of  people  2)  in  order  to  achieve  some  shared  purpose  3)  through  a  division  of 
labor  4)  integrated  by  information-based  decision  processes  5)  continuously  through 
time.”  The  terrorist  network  responsible  for  the  March  11,  2004  Madrid  attacks  can  be 
identified  as  an  organization  because: 

•  The  terrorist  cell  was  composed  of  different  individuals  and  groups  of 
people  (like  the  Spaniards  who  provided  the  explosives  or  the  Moroccan 
drug  smugglers  who  financed  the  attack); 

•  All  group  members  operated  for  a  specific  purpose  (the  bombing  attacks 
three  days  before  the  general  Spanish  elections); 

•  The  group  members  perfonned  different  tasks,  such  as  planning  the 
attacks,  training  for  the  attacks,  assembling  the  explosives  and  performing 
the  attacks.  The  division  of  labor  does  not  imply  that  every  member  did 
only  one  task  during  the  bombing  preparation  and  execution  process. 
Some  members  participated  in  multiple  tasks  before  the  Madrid  attacks 
(Haahr-Escolano,  2005); 

•  The  communication  among  the  terrorist  members  was  achieved  with  the 
use  of  cell  phones  or  occurred  when  they  met  in  specific  places  (a  safe 
house  outside  Madrid  and  a  phone  shop  that  was  owned  by  a  terrorist). 
These  meetings  and  communication  interactions  were  vital  to  the  group’s 
decision  cycle  and  to  the  information-based  decision  process  that  was 
occurring  within  the  specific  terrorist  network;  and 

•  All  of  the  points  mentioned  above  occurred  continuously  through  time. 

Thompson  (1967)  suggests  a  typology  of  three  types  of  interdependence  and 
coordination.  When  each  member  of  the  group  performs  a  task  that  is  not  dependent  on 
any  other  task,  and  the  overall  project  completion  is  the  sum  of  the  required  tasks,  then 
the  tasks  are  pooled  interdependent.  When,  in  addition  to  pooled  interdependence,  the 
tasks  are  performed  in  sequential  order  where  task  B  is  perfonned  after  the  completion  of 
task  A  and  task  A  is  not  dependent  on  task  B,  then  the  tasks  are  sequentially 
interdependent.  When,  in  addition  to  sequential  interdependence,  the  outputs  of  each  task 
become  the  inputs  of  other  tasks,  then  the  tasks  are  reciprocally  interdependent.  Different 


12 


types  of  coordination  manage  each  type  of  interdependence.  Pooled  interdependence  is 
managed  by  coordination  by  standardization,  which  is  the  establishment  of  rules  and 
procedures  according  to  which  the  members  operate.  Sequential  interdependence  is 
managed  by  coordination  by  plan,  where  a  schedule  is  established  for  the  members’ 
actions.  Finally,  reciprocal  interdependence  is  managed  by  coordination  by  mutual 
adjustment,  where  members  coordinate  based  on  environmental,  individual  and  group 
characteristics.  With  an  increase  of  uncertainty  in  the  environment,  members  tend  to  rely 
on  coordination  with  mutual  adjustment. 

A  terrorist  attack  appears  to  be  divided  in  distinct  sequential  tasks  in  the  abstract 
(e.g.,  plan,  finance,  get  the  explosives,  train,  and  execute),  but  closer  examination  of  the 
work  perfonned  by  terrorist  networks  implies  that  the  tasks  required  to  perform  an  attack 
are  reciprocally  interdependent  (e.g.,  the  output  of  planning  the  attack  affects  the  input  of 
financing  the  attack  and  vice  versa).  This  thesis  examines  the  tasks  perfonned  before  the 
Madrid  terrorist  attack,  which  were  reciprocally  interdependent. 

Thompson  (1967)  suggests,  “Organizations  seek  to  place  reciprocally 
interdependent  positions  tangent  to  one  another,  in  a  common  group  which  is  (a)  local 
and  (b)  conditionally  autonomous.”  Terrorist  groups  that  exist  in  different  countries 
worldwide,  after  9/11  and  the  wars  in  Afghanistan  and  Iraq,  operate  autonomously  at  a 
local  level  (Benjamin  &  Simon,  2005).  Therefore,  the  view  of  locally  autonomous 
terrorist  networks  keeps  pace  with  Thompson’s  proposition. 

Thompson  (1967)  also  proposes  that  ‘“Organizations  with  reciprocal 
interdependence  not  contained  by  departmentalization  rely  on  task-force  or  project 
groupings  to  accomplish  the  remaining  coordination.”  When  terrorist  networks  have 
members  with  low  levels  of  experience  and  different  backgrounds  (the  Madrid  terrorist 
cell)  (Wright,  2004)  there  is  not  sufficient  homogeneity  to  departmentalize  a  terrorist 
attack.  Therefore,  the  networks  rely  on  task  forces  or  project  groupings  to  accomplish  the 
required  coordination  for  a  specific  project,  which,  in  the  Madrid  case,  was  to  perform  a 
bombing  attack. 
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According  to  Galbraith  (1977),  individuals  with  low  levels  of  formalization  can 
outperform  members  with  high  formalization  when  they  operate  under  conditions  of  high 
uncertainty.  Also,  experience  is  a  key  factor  in  the  group’s  perfonnance.  Highly 
experienced  members  produce  fewer  exceptions  and  errors  than  the  inexperienced  ones  in 
either  stable  or  unstable  environments.  The  Madrid  terrorist  network  had  members  with 
low  formalization  (Benjamin  &  Simon,  2005).  The  network  did  not  have  distinct  jobs  for 
each  member,  and  the  members  were  characterized  as  “amateurs”  since  none  had 
participated  in  any  terrorist  training  camp  or  had  perfonned  terrorist  attacks  in  the  past 
(Haahr-Escolano,  2005).  All  these  theoretical  propositions  constitute  a  basis  for  the 
Agent  Based  Modeling  manipulations  described  in  the  research  design  in  Chapter  IV. 

D.  COMPUTATIONAL  ORGANIZATION  THEORY 

Computational  organization  theory  focuses  on  computations  and  simulations  of 
complex  organizational  models  that  cannot  be  analyzed  completely  with  quantitative  or 
qualitative  conventional  research  techniques  (Carley  &  Prietula,  1994).  Computational 
tools  are  designed  to  simplify  a  complex  real  world  problem.  If  the  problem  can  be 
simplified  without  losing  any  of  its  key  elements,  then  the  tool  is  of  some  value.  If  the 
problem  cannot  be  simplified  appropriately  with  the  available  tool,  then  the  results  will 
be  inaccurate  (Miller  &  Page,  2007).  Hence,  research  perfonned  with  computational  tools 
must  be  question  driven  and  not  tool  driven,  because  not  all  questions  can  be  answered 
with  all  computational  tools  (Burton  &  Obel,  1995).  In  this  thesis,  POW-ER  software  was 
carefully  selected  since  it  provides  insights  about  the  contingencies  that  affect  the  process 
of  performing  a  terrorist  attack  based  on  the  Madrid  bombing  case  study. 

According  to  Simon  (1996)  and  Eipstein  (1999),  computer-based  computational 
models  generate  virtual  environments  that  imitate  actions  and  behaviors  of  social  life 
based  on  real  world  observations.  The  model’s  simplicity  is  vital  in  every  simulation. 
Every  model  must  be  complex  up  to  the  point  where  no  critical  attribute  or  element  is 
excluded  from  the  model  (Burton  &  Obel,  1995).  Some  details  from  the  real  world  can  be 
ignored  as  soon  as  the  main  building  blocks  have  been  captured  by  the  model  (Miller  & 
Page,  2007).  Simon  (1996)  suggests  that  “we  do  not  have  to  know,  or  guess  at,  all  the 
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internal  structure  of  the  system  but  only  that  of  it  that  is  crucial  to  the  abstraction.”  Carley 
and  Prietula  (1994)  do  not  refute  the  need  for  simplicity;  however,  they  emphasize  three 
reasons  for  adding  the  necessary  complexity  to  a  computational  model.  The  first  reason  is 
that  the  problem  may  contain  nonlinearities  that  cannot  be  represented  in  a  different  way. 
Second,  some  modelers  use  discrete  variables  that  need  to  be  analyzed  with  difference 
equations,  and  others  use  continuous  variables  that  need  to  be  analyzed  with  differential 
equations.  Difference  equations  increase  the  realism  of  organizational  simulation  models 
because  organizations,  people  and  facts  are  discrete  variables,  but  decrease  the  solvability 
of  the  model.  Researchers  should  determine  the  complexity  of  their  models  based  on  the 
organization  under  study  and  the  research  question  they  try  to  answer.  Third,  agents  are 
adaptive  to  other  agents’  behavior;  therefore,  group  behavior  is  “self-referential”.  In  this 
thesis,  the  baseline  model  of  the  Madrid  terrorist  cell,  as  it  is  presented  in  Chapter  IV,  is 
an  abstraction  that  captures  the  key  elements  of  the  terrorist  network,  ignoring  any 
information  that  is  not  crucial  to  the  research  question. 

There  are  mainly  two  approaches  in  computational  modeling.  The  top  down 
approach  abstracts  general  properties  from  the  real  world  and  with  the  use  of  feedback 
loops  examines  the  system’s  behavior  (Epstein  &  Axtell,  1996).  The  bottom  up  approach 
focuses  on  the  interactions  at  the  lowest  level  of  the  system  (the  individual  level)  which, 
by  simulation,  generates  the  emerging  system  behavior  (Burton  &  Obel,  1995).  Agent 
Based  Modeling  (ABM)  is  a  bottom  up  approach  that  examines  the  system’s  behavior 
based  on  the  agents’  interactions.  Each  agent  in  ABM  may  follow  its  own  behavior  rules, 
adding  complexity  and  realism  to  the  model.  ABM  can  be  generated  even  if  there  is 
ignorance  about  the  general  behavior  of  the  system.  If  the  agents’  interactions  are  known, 
then  the  general  properties  of  the  system  emerge  with  the  simulation  of  these  low  level 
interactions  (Miller  &  Page,  2007).  Borshchev  and  Filippov  (2004),  after  taking  into 
consideration  various  simulation  techniques  (Agent  Based  Modeling,  System  Dynamics, 
Discrete  Events  and  Dynamic  Systems),  suggest  that,  for  systems  that  contain  large 
number  of  agents,  “Agent  Based  Modeling  is  more  general  and  powerful  because  it 
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enables  to  capture  more  complex  structures  and  dynamics.”  ABM  is  also  powerful  for 
small-scale  systems  when  the  overall  behavior  of  the  system  is  unknown  but  the 
behaviors  at  the  individual  level  are  known.  This  is  a  major  reason  why  ABM  was 
selected  for  this  thesis. 
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III.  THE  MADRID  ATTACK 


This  chapter  covers  the  background  of  the  terrorist  group  that  was  responsible  for 
the  March  11,  2004,  Madrid  bombings,  and  the  events  that  occurred  from  the  day  of  the 
attack  until  the  capture  of  the  core  members  of  the  terrorist  cell. 

A.  THE  MADRID  TERRORIST  CELL 

The  appearance  of  terrorist  groups  in  Spain  dates  back  to  the  early  1980s.  On  July 
20,  1984,  the  Spanish  police  arrested  an  Iranian  terrorist,  a  member  of  the  terrorist  group 
“Martyrs  of  the  Islamic  Revolution,”  who  was  planning  to  bomb  a  Saudi  plane  in  Madrid. 
That  same  year,  the  group  “Islamic  Jihad”  killed  citizens  with  Saudi  ties  inside  Spanish 
territory;  they  were  accused  of  bombing  a  restaurant  in  Torrejon  in  1985.  Several  years 
later,  the  Spanish  police  captured  members  of  a  terrorist  group  with  links  to  Hezbollah 
who  were  transporting  a  large  quantity  of  explosives  through  Spain  to  France  (Jordan  & 
Horsburgh,  2005).  All  the  attacks  that  occurred  during  the  1980s  were  performed  by 
individuals,  members  of  Jihadi  cells  who  were  neither  Spanish  residents  nor  citizens. 
However,  the  groups  that  emerged  during  the  1990s  were  composed  primarily  of  Spanish 
residents.  The  most  important  of  these  groups  were  the  Algerian  Jihadi  network  and  the 
Madrid  bombing  network.  These  two  groups  were  not  acting  independently,  since  some 
individuals  participated  in  both  networks.  This  thesis  examines  the  Madrid  terrorist 
network  and  highlights  its  connections  with  other  terrorist  groups. 

After  the  9/11  attacks,  the  Spanish  police  identified  a  terrorist  cell  in  Spain  that 
was  connected  with  A1  Qaeda.  Imad  Eddin  Barakat  Yarkas,  aka  Abu  Dahdah,  was 
believed  to  be  the  leader  of  this  cell,  which  was  part  of  the  Algerian  Jihadi  network. 
Dahdah  was  captured  in  November  2001  (Haahr-Escolano,  2005;  Green,  2005). 
According  to  the  Spanish  authorities,  his  arrest  resulted  in  the  disruption  of  the  terrorist 
cell  (Benjamin  &  Simon,  2005;  Green,  2005).  According  to  the  Eleventh  March  (11-M) 
Commission  that  was  formed  after  the  Madrid  attacks  in  2004,  the  Spanish  authorities 
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failed  to  understand  the  extent  of  the  Jihadi  terrorist  network  in  Spain  after  the  arrest  of 
Dahdah  in  2001,  and  they  underestimated  the  threat  of  terrorist  attacks  by  Jihadi  groups 
on  Spanish  soil. 

After  Dahdah’ s  arrest,  the  Moroccan  Amer  Azizi,  who  had  close  ties  with 
Dahdah,  started  recruiting  individuals,  mainly  of  Moroccan  origin  who  had  some 
connections  with  Moroccan  extremist  groups  or  shared  common  beliefs  about  the  “holy 
war”  against  the  Westerners  (Jordan  &  Horsburgh,  2005).  One  of  the  first  members  to 
join  the  group  was  Sarhane  Ben  Abdehnajin  Fakhet  (known  also  as  “The  Tunisian”).  He 
was  the  leader  and  coordinator  of  the  Madrid  bombings  (BBC  News  April  4,  2004; 
Bennhold,  2004;  Wright,  2004),  and  he  had  been  planning  the  attack  with  Rabei  Osman 
el-Sayed  Ahmed  (“Muhammad  the  Egyptian”)  since  2003  (Benjamin  &  Simon,  2005). 
Fahket  had  lived  in  Spain  for  eight  years,  studied  economics  (Benjamin  and  Simon,  2005; 
BBC  News,  April  5,  2004)  at  the  Autonomous  University  of  Madrid  (Bennhold,  2004) 
and  also  worked  as  a  real  estate  agent  (Wright,  2004). 

Muhammad  the  Egyptian  was  referred  as  the  Architect  of  the  attacks.  He  was  an 
expert  in  bombs  due  to  his  service  in  the  Egyptian  Anny  as  a  specialist  in  explosives 
(BBC  News,  March  10,  2005;  Wright,  2004);  he  was  the  only  member  of  the  terrorist  cell 
with  such  expertise.  Despite  his  previous  military  experience,  he  had  not  previously 
joined  any  A1  Qaeda  training  camps  or  fought  for  the  Jihad  abroad.  A  conversation 
between  him  and  another  terrorist  on  the  cell  phone  some  days  after  the  attacks  was 
recorded;  in  this  recording,  he  clearly  stated  that  the  Madrid  bombings  were  his  project. 
“I  was  ready  to  blow  myself  up,  but  they  stopped  me,  and  we  obey  God's  will,”  he  said. 
“I  had  wanted  a  heavy  burden,  but  I  didn’t  find  the  means.  This  plan  cost  me  a  lot  of 
study  and  patience.  It  took  me  two  and  a  half  years”  (Sciolino  &  Horowitz,  2004). 

Jamal  Ahmidan,  Fakhet’s  right  hand  man,  was  a  Moroccan  who  was  the  cell 
commander  of  the  terrorist  group  (BBC  News,  April  4,  2004;  BBC  News,  April  5,  2004; 
Benjamin  &  Simon,  2005;  Wright,  2004)  and  was  involved  in  small  drug  smuggling 
(Jordan  &  Wesley,  2006)  with  the  Oulad  Brothers  and  Abdennabi  Kounjaa  (Benjamin  & 
Simon,  2005;  Wright,  2004).  Ahmidan  was  also  the  cell  recruiter:  he  had  recruited 

Moroccans  such  as  Kounjaa  and  the  Oulad  brothers,  who  had  no  prior  terrorist 
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experience.  Ahmidan  did  not  plant  any  bombs  on  the  day  of  the  attack,  but  he  rented  a 
farmhouse  outside  Madrid  where  the  bombs  probably  were  assembled.  His  connections 
with  criminals  provided  the  group  the  necessary  links  to  the  bomb  providers.  Ahmidan 
exchanged  drugs  for  explosives  with  a  drug  dealer,  Jose  Emilio  Suarez  Trashorras,  who 
had  friends  who  were  miners  and  could  steal  some  explosives  from  their  workplace 
(Benjamin  &  Simon,  2005).  Ahmidan  received  200  kg  of  Goma-2  explosives  and 
transported  them  to  the  rented  farmhouse. 

The  members  of  the  terrorist  group  assembled  the  bombs  by  connecting  the 
explosives  with  cell  phones  and  detonators  and  placing  them  inside  large  handbags.  What 
remains  unknown  is  how  the  members  of  the  group  acquired  the  knowledge  to  build  the 
bombs.  They  may  have  gathered  this  information  through  manuals  or  other  sources  found 
on  internet  sites,  since  the  internet  has  become  a  virtual  training  camp  for  terrorist  cells 
(Wiemann,  2006).  Evidence  supporting  this  view  has  not  been  found  yet;  therefore,  this 
thesis  assumes  that  the  knowledge  and  the  guidance  for  the  bomb  building  process  was 
provided  by  Rabei  Osman  el-Sayed  Ahmed  (Muhammad  the  Egyptian  or  The  Architect), 
since  he  was  the  only  member  of  the  group  who  was  an  expert  in  bombs  (Wright,  2004). 

Before  the  attacks,  many  of  the  members  of  the  Madrid  terrorist  network  were 
captured  by  the  police  for  other  crimes  (e.g.,  drug  smuggling)  at  different  times,  but  they 
never  were  connected  to  any  terrorist  group.  The  Spanish  authorities’  false  belief  that  the 
terrorist  network  in  Spain  was  neutralized  after  Abu  Dahda’s  arrest  in  2001  resulted  in 
the  lack  of  correlation  between  terrorism  activities  and  drug  smuggling  crimes.  If  that 
correlation  had  occurred  earlier,  the  terrorist  cell  could  have  been  delayed  or  even 
disrupted  since  it  would  not  have  had  the  funds  to  perform  a  bombing  attack  (Haahr- 
Escolano,  2005). 

The  Madrid  terrorist  group  did  not  have  any  financial  relations  with  any  A1  Qaeda 
operatives.  The  group  was  self-funded,  and  most  of  its  resources  came  from  drug 
smuggling  activities  (Benjamin  &  Simon,  2005;  Wright,  2004).  For  the  jihadists,  outlaw 
activity  is  acceptable  only  when  it  is  carried  out  for  the  sake  of  the  Jihad  (Haahr- 
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Escolano,  2005).  The  whole  operation’s  cost  was  about  $50,000,  which  is  a  very  small 
amount  considering  the  level  of  casualties  and  the  effects  the  bombings  had  on  Spain’s 
policy  regarding  its  troops  in  Iraq  (Benjamin  &  Simon,  2005). 

B.  THE  2004  MADRID  BOMBINGS 

On  March  11,  2004,  one  of  the  largest  terrorist  attacks  in  the  history  of  Spain 
occurred,  causing  the  deaths  of  191  people  and  wounding  1800  more  (Jordan  &  Wesley, 
2006).  The  purpose  of  the  attack,  consistent  with  the  fact  that  it  occurred  three  days 
before  the  general  elections,  was  to  pressure  the  Spanish  government  to  withdraw  its 
troops  from  Iraq  (Haahr-Escolano,  2005;  Benjamin  &  Simon,  2005).  The  terrorists 
viewed  the  attacks  as  a  message  to  the  other  countries  that  had  troops  in  Iraq  to  either 
withdraw  them  or  live  under  the  fear  of  a  similar  attack  on  their  own  soil  (Wright,  2004). 

The  attacks  occurred  on  four  trains:  three  originating  from  Alcala  de  Henares  (a 
village  18  miles  northeast  of  Madrid)  and  one  from  Guadalajara.  The  first  train  departed 
from  Alcala  de  Henares  at  0604  GMT,  and  the  other  two  left  fifteen  minutes  apart  (BBC 
News,  April  4,  2004;  Benjamin  &  Simon,  2005).  At  0639  GMT,  when  the  first  train 
reached  the  Atocha  station,  three  bombs  exploded  in  three  different  wagons  of  the  train. 
At  the  same  time,  another  three  bombs  detonated  on  the  second  train,  which  was  two 
minutes  delayed,  500  yards  from  Atocha  station.  Ninety-three  people  were  killed  and 
hundreds  were  wounded  in  these  two  attacks  (Benjamin  &  Simon,  2005).  Two  minutes 
later,  two  bombs  detonated  on  the  third  train  that  had  departed  from  Alcala  de  Henares. 
This  attack  occurred  at  the  El  Pozo  station,  which  was  the  previous  station  on  the  train 
route  before  the  Atocha  station.  This  attack  killed  70  people  and  wounded  many  more.  If 
the  train  had  not  been  delayed,  there  probably  would  have  been  more  innocent  victims, 
since  a  quarter  million  passengers  pass  through  the  Atocha  station  every  day  (Wright, 
2004).  One  minute  later,  a  bomb  exploded  on  the  fourth  train  while  it  was  passing 
through  the  Santa  Eugenia  station  two  stations  away  from  the  Atocha  station  (Benjamin 
&  Simon,  2005). 
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All  Spanish  emergency  services  rushed  to  the  bombing  scenes  to  provide  help  to 
wounded  citizens  (BBC  News,  April  4,  2004).  While  the  emergency  rescuers  were 
searching  the  train  wreckage  for  survivors,  they  frequently  came  across  various 
passengers’  belongings,  which  they  delivered  to  the  local  police  station  after  their  sector 
search  was  over. 

Hours  after  the  attack,  the  Popular  Party  Prime  minister  Jose  Maria  Aznar 
declared  that  the  Basque  terrorist  group  Euskadi  Ta  Askatasuna  (ETA)  was  responsible 
for  the  attacks,  since  they  occurred  three  days  before  the  general  elections,  and  ETA  had 
performed  bombings  on  trains  in  the  past  (Haahr-Escolano,  2005;  Benjamin  &  Simon, 
2005;  Wright,  2004).  According  to  members  of  the  Popular  Party,  ETA  wanted  to  bring 
chaos  to  the  elections.  However,  early  findings  indicated  that  the  methods  used  in  the 
attacks  were  not  similar  to  the  methods  used  by  the  Basque  terrorist  group  in  the  past. 
ETA’s  attacks  always  came  with  a  warning,  and  their  targets  were  not  innocent  civilians, 
since  this  would  have  a  negative  impact  on  ETA’s  popularity  among  the  Spaniards 
(Wright,  2004). 

After  the  9/11  attacks,  a  rental  car  that  had  flight  manuals  in  Arabic  was  found 
near  Boston’s  airport.  Based  on  this  knowledge,  the  authorities  immediately  investigated 
a  report  about  an  abandoned  Renault  Kangoo  outside  Alcala  de  Henares  station.  Inside 
the  van,  the  police  found  seven  detonators  and  a  tape  with  verses  from  the  Koran  in 
Arabic.  This  clue  was  a  clear  indication  that  Islamic  extremists  may  have  been 
responsible  for  the  train  attacks  that  had  occurred  earlier  that  day  (Benjamin  &  Simon, 
2005). 

Twelve  hours  after  the  attack,  a  cell  phone  rang  inside  a  bag  that  was  found  at  the 
El  Pozo  station.  The  police  opened  the  bag  and,  to  their  surprise,  found  that  the  cell 
phone  was  attached  to  two  detonators  that  were  connected  to  explosives.  The  bag  also 
contained  screws  and  nails  in  order  to  cause  more  deaths  once  it  exploded.  This  was 
clearly  a  bomb  that  had  failed  to  detonate.  The  police  examined  the  SIM  card  that  was 
inside  the  phone  and  obtained  evidence  that  led  to  the  arrest  of  five  suspects:  three 
Moroccans  and  three  of  Indian  origin  (BBC  News,  April  4,  2004;  Benjamin  &  Simon, 

2005).  The  Spanish  authorities  interrogated  the  suspects  and  found  connections  with  the 
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terrorist  group  that  had  performed  similar  attacks  in  Casablanca  the  previous  May,  killing 
forty-one  civilians  (BBC  News,  May  17,  2003).  This  Moroccan  group  had  close  ties  with 
A1  Qaeda,  and  the  Spanish  authorities  were  almost  convinced  that  ETA  had  not 
performed  the  terrorist  attack. 

The  final  confirmation  that  Jihadi  groups  were  behind  the  attack  came  from  a 
videotaped  message  in  Arabic  that  was  received  on  March  13,  2004,  in  which  a  man 
declared  responsibility  for  the  attacks.  In  the  message  he  clearly  said,  “We  declare  our 
responsibility  for  what  happened  in  Madrid  ...  It  is  a  response  to  your  collaboration  with 
the  criminals  Bush  and  his  allies  ...  There  will  be  more  if  God  wills  it.  You  love  life  and 
we  love  death  ...  if  you  don’t  put  an  end  to  your  injustices  more  and  more  blood  will  run.” 
(Wright,  2004) 

The  terrorist  cell  did  not  use  all  of  the  explosives  it  had  in  its  possession  for  the 
March  11,  2004,  attacks.  Bombs  similar  to  those  that  were  used  for  the  March  1 1  attacks 
were  found  on  the  Madrid-Seville  speed  train  on  April  2,  which  indicated  that  the 
terrorists  were  planning  to  perform  more  attacks,  but  an  unknown  and  unexpected  event 
on  April  2  ruined  their  plans  (Benjamin  &  Simon,  2005;  Wright,  2004). 

On  April  3,  2004,  the  police  had  indications  that  the  terrorists  were  in  an 
apartment  in  a  suburb  of  Leganes,  an  area  south  of  Madrid.  A  police  force  surrounded  the 
building  and  asked  the  terrorists  to  surrender.  Instead,  the  terrorists  blew  themselves  up, 
wounding  a  police  officer  in  the  process.  The  leader,  the  cell  commander  and  five 
members  of  the  terrorist  cell  were  among  the  dead  terrorists  (BBC  News,  April  4,  2004; 
Bennhold,  2004). 
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IV.  RESEARCH  DESIGN 


This  chapter  initially  covers  the  research  method  and  frames  the  Baseline  model, 
which  is  an  abstraction  based  on  real  world  data  from  academic  papers  and  news  articles 
about  the  terrorist  cell  that  performed  the  2004  Madrid  attack.  The  research  design  then 
describes  the  Expert  and  the  Hierarchical  models,  and  the  manipulations  made  for  each 
model  that  was  created  based  on  the  baseline  model.  In  design  terms,  this  chapter 
suggests  a  3  x  2  factorial  design  with  three  different  representations  of  a  specific  terrorist 
group  (i.e.,  the  Baseline,  the  Expert  and  the  Hierarchical  models),  under  two  different 
mission-environmental  contexts  (i.e.,  Baseline  and  high  counterterrorist  conditions). 

A.  RESEARCH  METHOD 

Virtual  Design  Team  (VDT)  models  are  Agent  Based  Models,  and  the  VDT 
program  has  been  developing  continuously  accumulating  research  for  more  than  two 
decades,  building  organizational  models  based  on  real  world  cases  in  order  to  examine 
their  underlying  organizational  processes  (Levitt  et  ah,  1999).  VDT  modeling  is  based  on 
an  infonnation  processing  view  of  organizations  developed  by  Galbraith  (1977),  Simon 
(1976),  and  March  and  Simon  (1958).  According  to  Galbraith  (1977),  organizations  are 
information  processing  systems  that  have  a  specific  communication  and  information 
exchange  infrastructure  in  which  lower  level  information  processors  (individuals  or 
teams)  have  predefined  roles  and  accomplish  specific  tasks.  These  individuals  or  teams 
send  information  through  some  formal  lines  of  communication  and  information  exchange 
(e.g.,  telephone  lines  and  mails)  that,  depending  on  the  way  they  are  organized  (e.g.,  as 
Machine  Bureaucracy  or  Adhocracy  (Mintzberg,  1980))  and  the  sequence  of  the  tasks 
that  have  to  be  completed,  affect  overall  organizational  performance.  The  actors’ 
information  capacity  is  limited  following  the  model  of  “bounded  rationality”  proposed  by 
Simon  (1976).  Hence,  the  VDT  models  can  predict  the  performance  of  alternative 
organizational  configurations  that  perform  a  specific  task  (Carley  &  Prietula,  1994). 


23 


The  VDT  models  are  agent-based  representations,  exploring  the  organization’s 
aggregative  behaviors  using  the  bottom  up  approach.  So,  by  simulating  the  micro-level 
organizational  behaviors  (individual  actors  or  groups),  the  researcher  can  use  simulation 
to  explore  the  aggregative  effects  on  the  macro-organizational  level  (Levitt  et  al.,  1999). 
Figure  1  illustrates  the  information  processing  view  of  the  work  accomplished  by  an  actor 
who  is  part  of  an  organization  and  performs  specific  tasks  while  communicating  with  the 
other  members.  The  actor’s  “In  Tray”  represents  the  inputs  that  are  provided  to  the  actor. 
These  inputs  can  be  the  direct  work  that  has  to  be  perfonned  for  some  tasks,  meetings  to 
attend,  or  even  communications  requests  from  other  actors.  The  actor  performs  each  task 
sequentially;  therefore,  he  proceeds  to  the  next  task  after  the  previous  one  has  been 
completed.  The  “Out  Tray”  represents  the  outcomes  that  emerge  from  a  specific  actor. 
These  outcomes  can  be  the  completion  of  a  specific  task,  attendance  at  a  meeting,  or 
communication  with  another  actor.  The  way  an  actor  manages  his  inputs  in  order  to 
generate  the  outcomes  depends  on  his  acquired  skill  level,  the  existing  backlog,  and  the 
number  of  communications  that  are  received  from  other  actors.  The  actor’s  outcome  will 
vary,  depending  on  how  much  the  actor’s  skill  matches  the  skill  required  for  a  specific 
activity.  Of  course,  as  was  mentioned  before,  the  work  backlog  and  the  number  of 
communications  from  other  actors  can  affect  the  outcome  since  these  tasks  divert  the 
actor’s  attention. 
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Figure  1.  The  view  of  organization  structure  with  the  actors  and  the  tasks  (After: 
Nissen  &  Levitt,  2004) 


24 


The  VDT  modeling  program  has  been  extensively  validated  over  the  years  by 
using  fieldwork  data  in  order  to  create  the  simulation  models  that  represent  the 
organizations  under  examination.  Studies  in  various  fields  of  industry,  such  as  power 
plant  construction  (Christiansen,  1993),  aerospace  (Thompsen,  1998),  software 
development  (Nogueira,  2000)  and  healthcare  (Cheng  &  Levitt,  2001),  have  been 
conducted  with  the  use  of  VDT  simulation,  emphasizing  its  applicability  in  the  real 
world.  The  models  are  created  with  the  use  of  information  possessed  by  the  organization 
at  the  starting  point  of  the  period  under  examination.  Then  the  generated  behavior  from 
the  simulation  is  compared  with  the  actual  real  world  data  and  is  provided  to  the 
researchers  by  the  organization’s  managers.  If  the  computational  results  are  similar  to  the 
real  world  data,  then  the  model  can  be  characterized  as  a  “good”  abstraction  of  reality  and 
can  be  used  for  further  analysis.  This  process  is  called  “backcasting,”  and  it  is  a  docking 
technique  used  by  the  VDT  in  order  to  validate  the  generated  models  (Kunz  et  ah,  1998). 
Backcasting  has  been  used  extensively  by  researchers  (Christiansen,  1993;  Thompsen, 
1998;  Cheng  and  Levitt,  2001).  This  thesis  examines  the  March  11,  2004  Madrid 
bombings  by  using  the  method  of  “backcasting”  in  order  to  develop  the  baseline  model. 
This  thesis  follows  all  the  stages  of  “backcasting”  except  from  the  last  comparison  stage; 
data  could  not  be  provided  by  the  terrorists  since  most  of  them  are  dead  and  the  living  are 
hard  to  reach.  The  studies  that  have  been  performed  analyzing  the  terrorist  network  that  is 
responsible  for  the  2004  Madrid  bombings  (Jordan  and  Horsburgh,  2005;  Rodriguez, 
2008)  are  used  instead. 

In  order  to  summarize  the  VDT  modeling  structure  and  emphasize  the  value  of 
the  knowledge  created  with  the  use  of  this  computer  simulation,  it  is  useful  to  represent 
VDT  as  an  Inquiring  System  (Mitroff  &  Murray,  1993;  Mitroff,  1995).  Figure  2 
illustrates  Mitroff  s  Inquiring  System.  Inquiring  Systems  are  systems  that  create  “new 
knowledge”  based  on  some  process,  given  certain  inputs.  The  main  components  of  an 
Inquiring  System  are  the  inputs,  the  process  that  receives  the  inputs  and  generates  new 
knowledge,  the  outputs  or  the  new  created  knowledge,  and  the  guarantors  for  the  inputs 
and  the  process. 
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Guarantor 
for  the  input 


Output  or 


Figure  2.  Mitroff  s  Inquiring  System 


The  inputs  for  the  VDT  model  are  the  organizational  structure,  the  activities 
performed  by  the  members  of  the  organization,  the  process  description  of  the  project 
under  examination,  the  actors  and  the  communication  lines  among  them  (including 
coordination  and  rework  links)  (Kunz  et  ah,  1998).  In  this  thesis,  the  inputs  are  provided 
after  extensive  research  through  academic  papers  and  articles  that  describe  or  analyze  the 
Madrid  bombing  attacks.  Hence,  the  guarantors  for  the  inputs  are  the  cross-validated  real 
world  data  that  provide  information  for  the  specific  case  study.  The  process  is  the  VDT 
simulation  model  and  the  guarantor  for  the  process,  as  mentioned  above,  is  the  research 
conducted  with  the  VDT  simulation  for  over  two  decades  in  various  industries  that 
provides  external  validity  to  the  simulation  software.  The  output  of  VDT  comprises 
quantitative  measures  of  the  required  coordination,  rework,  total  work,  and  others, 
including  the  various  kinds  of  risks  (communication,  functional  and  project  risk), 
required  for  project  completion.  These  measures  indicate  how  the  inputs  affect  the 
outcome  and  provide  useful  insights  about  the  effect  of  different  contingency  factors  on 
project  completion.  In  this  thesis,  the  outcome  also  proposes  counterterrorist  policies  that 
could  be  adapted  to  thwart  terrorist  networks. 
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B. 


THE  BASELINE  MODEL 


The  POW-ER  Agent  Based  Modeling  application  used  in  this  research  is  version 
3.5b,  and  represents  a  continuation  of  development  (see  Nissen  and  Levitt  2004;  Looney 
and  Nissen,  2006;  Nissen,  2005a;  Nissen,  2005b)  that  has  its  roots  in  the  VDT  research 
program.  Any  bugs  or  errors  that  may  be  inherent  in  POW-ER  3.5b  are  controlled  and 
applied  consistently  across  all  models.  Hence,  even  though  some  results  may  have  some 
errors,  these  errors  apply  to  all  models,  leaving  unaffected  the  relative  comparison  that  is 
of  essence  in  this  thesis. 


Figure  3.  Madrid  Cell  Baseline  Model 

Figure  3  illustrates  the  baseline  model  of  the  terrorist  network  that  perfonned  the 
2004  Madrid  terrorist  bombings.  Behind  each  object  in  the  baseline  model,  either  an  actor 
or  a  task,  are  a  number  of  model  parameters  that  are  set  to  describe  the  nature  and  the  key 
attributes  that  create  the  overall  behavior  of  the  system.  Most  of  these  parameters  are  set 
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to  “normal”  levels  based  on  organizations  that  have  been  examined  in  the  past  (Jin  & 
Levitt,  1996;  Levitt  et  al.,  1999;  Nissen  &  Levitt,  2004;  Nissen  &  Leweling,  2007).  The 
structure  of  the  Madrid  network  was  decentralized  and  could  be  characterized  as  an 
Edge-like  structure  (Alberts  &  Hayes,  2003).  The  Edge  (Alberts  &  Hayes,  2003)  is  an 
organizational  archetype  with  particular  applicability  in  the  C2  domain  (see  Nissen, 
2005a,  Orr  &  Nissen,  2006).  The  Edge  shares  similarities  with  the  Adhocracy  (e.g., 
coordination  by  mutual  adjustment,  small  unit  size,  many  liaison  links  throughout, 
selective  decentralization),  Professional  Bureaucracy  (e.g.,  low  vertical  specialization, 
high  training  and  indoctrination,  market  and  functional  grouping),  and  Simple  Structure 
(e.g.,  low  horizontal  specialization,  low  formalization).  The  Edge  organization  also 
demonstrates  several  key  differences,  and  it  does  not  correspond  cleanly  with  any  single 
archetype.  Key  to  Edge  characterization  are  decentralization,  empowerment,  shared 
awareness  and  freely  flowing  knowledge,  which  are  required  to  push  power  for  informed 
decision  making  and  competent  action  to  the  “edges”  of  organizations  (Alberts  &  Hayes, 
2003),  where  they  interact  directly  with  their  environments  and  other  players  in  the 
corresponding  organizational  field  (Scott,  2001).  Therefore,  some  general  parameters 
(e.g.,  noise  and  communications  probability)  were  set  to  “normal”  levels  based  on 
previous  research  about  terrorist  groups  with  Edge  and  Hierarchical  structure,  that  was 
conducted  with  the  use  of  POW-ER  software  at  a  theoretical  level  (Nissen  &  Leweling, 
2007).  The  model  has  a  start  and  a  finish  point  (on  the  far  left  and  right  of  the  figure). 
Each  run  begins  at  the  start  point  and  ends  when  it  reaches  the  finish  point.  Using  a 
Monte  Carlo  approach,  each  scenario  is  run  100  times. 

The  actors  of  the  terrorist  group  (human  figures)  represent  either  an  individual  or 
a  group  of  people.  The  actors’  names  are  mentioned  based  on  their  roles.  A  representation 
of  the  actors  with  their  real  names  based  on  the  Madrid  case  study  was  avoided:  it  is  out 
of  the  scope  of  this  thesis  since  the  focus  is  not  on  the  individuals  themselves.  On  the 
other  hand,  each  actor  has  the  attributes  of  the  participant  or  the  group  that  participated  in 
the  Madrid  terrorist  network.  For  example,  Fakhet,  who  was  the  leader  and  coordinator  of 
the  cell,  is  represented  as  an  individual  who  has  a  team-leading  role.  The  financers  are  a 
group  of  four  individuals  composed  of  Jamal  Ahmidal,  the  Oulad  Brothers  and 


28 


Abdennabi  Kounjaa  (BBC  News,  March  10,  2005;  Benjamin  and  Simon,  2005).  The 
baseline  model’s  network  is  compared  with  existing  Social  Network  Analysis  networks 
that  have  examined  the  2004  Madrid  terrorist  network.  Even  though  the  representation  is 
different  and  the  analysis  is  made  with  a  completely  different  method,  as  described  in 
Chapter  II,  the  SNA  networks  and  the  baseline  model  network  have  the  same  number  of 
core  participants,  and  the  description  of  each  member  is  identical  (Jordan  and  Horsburgh, 
2005;  Rodriguez,  2008).  Hence,  the  empirical  representation  of  the  actors  and  their 
attributes  used  in  the  baseline  model  are  consistent  with  the  existing  data  from  SNA 
academic  papers. 

The  boxes  that  are  directly  connected  with  the  actors  represent  the  tasks 
performed  by  the  actors.  The  tasks  are  sequentially  interconnected,  some  in  series  and 
some  in  parallel.  Initially,  the  attack  is  planned  by  the  architect  and  the  leader,  and 
afterwards  the  tasks  are  perfonned  in  three  parallel  branches  that  have  the  same  amount 
of  total  work.  The  top  branch  is  composed  of  the  finance  and  weaponize  (buy  and 
assemble  the  explosives)  tasks.  At  the  same  time,  team  members  train  for  the  attack, 
meaning  that  they  identify  targets  and  check  the  train  routes;  this  forms  the  second 
branch.  During  the  same  period,  the  leader  has  a  coordinating  role  overseeing  the 
progress  of  the  plan,  which  forms  the  third  branch.  When  the  attack  is  ready  (represented 
by  the  milestone  “attack  ready”),  team  members  execute  the  attack.  The  time  periods 
needed  for  the  completion  of  each  task  were  impossible  to  select  with  accuracy,  since 
most  of  the  members  of  the  cell  committed  suicide  approximately  one  month  after  the 
attacks  (BBC  News,  April  4,  2004).  According  to  Benjamin  &  Simon  (2005),  Sahrane, 
who  was  the  coordinator  of  the  attack,  stopped  showing  up  for  work  by  the  fall  of  2003. 
Moreover,  on  October  19,  2003,  bin  Laden  released  two  videotapes  in  which  he  prompted 
Jihadi  groups  for  an  attack  against  the  countries  that  participated  in  the  war  in  Iraq,  such 
as  Spain,  Poland,  Italy  and  Japan.  A  Spanish  official  suggested  that  the  cell  started  the 
planning  of  the  attack  the  day  after  the  messages’  release  (Benjamin  &  Simon,  2005). 
Therefore,  the  total  “project’s”  time  was  set  to  four  months  in  our  models.  The 
coordinator  was  performing  his  task  during  the  whole  four  month  period,  except  during 
the  execution  phase;  Sahrane  (the  coordinator)  stayed  at  the  farmhouse  (the  place  where 
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the  terrorist  met  and  assembled  the  bombs)  the  day  of  the  attack  and  was  not  part  of  the 
“execution  phase  group.”  In  addition,  the  terrorists  acquired  the  explosives  in  January 
2004  (Benjamin  &  Simon,  2005)  and  had  only  the  next  month  (February  2004)  to 
assemble  them.  Therefore,  the  finance  and  weaponize  task  was  set  to  one  month  each. 
Hence,  the  first  two  months  were  devoted  to  planning.  The  analysis  of  the  network  is 
performed  comparatively;  therefore,  errors  that  may  exist  in  the  model’s  task  durations 
do  not  influence  the  outcome  of  this  thesis. 


Parameter 

Baseline 
Model  Values 

Application  Experience 

Low 

Skill  Level 

Low 

Task  Uncertainty 

Medium 

Task  Complexity 

Medium 

Rework  Strength 

0.10 

Centralization 

Low 

Formalization 

Low 

Team  Experience 

Low 

Matrix  Strength 

High 

Communication  Probability 

0.60 

Noise  Probability 

0.20 

Functional  Exception  Probability 

0.15 

Project  Exception  Probability 

0.15 

Organizational  Levels 

1 

Table  1.  The  Main  Parameters  of  the  Baseline  Model 


The  key  parameters  of  the  baseline  model  are  summarized  in  Table  1.  According 
to  Galbraith’s  view  of  organizations  as  information  processing  systems,  exceptions  are 
situations  in  which  an  actor  does  not  have  the  required  information  to  accomplish  a  task, 
which  normally  requires  him  or  her  to  go  to  a  higher  level  in  the  hierarchy  or  to  a 
knowledgeable  person  in  order  to  handle  the  created  exceptions.  However,  an  exception 
may  be  handled  or  ignored.  If  it  is  ignored,  it  causes  a  decrease  in  the  project’s  (e.g.,  the 
terrorist  attack)  quality.  Each  task  requires  a  skill  that  needs  to  be  matched  with  the 
actor’s  skill  in  order  to  generate  as  few  exceptions  as  possible.  Therefore,  if  an  actor  who 
performs  a  task  has  a  high  level  of  a  specific  skill  that  is  required  for  the  task  (for 


30 


example,  an  expert  on  weapons  is  performing  the  “weaponize”  task),  then  the  task  will  be 
performed  with  few  exceptions.  Application  experience,  on  the  other  hand,  is  the  level  of 
experience  the  actor  has  on  the  assigned  task. 

The  main  distinction  between  application  experience  and  skill  level  is  that  an 
actor  may  have  a  high  level  skill  that  matches  the  skill  required  for  task  completion,  but 
have  no  prior  experience  with  the  execution  of  the  specific  task.  In  the  Madrid  terrorist 
cell,  the  financers  had  no  prior  experience  with  financing  a  terrorist  act,  so  their 
application  experience  is  set  to  low.  In  general,  the  design  and  the  execution  of  the  2004 
Madrid  terrorist  attacks  were  not  done  by  A1  Qaeda  operatives  (Benjamin  and  Simon, 
2005).  The  Madrid  terrorist  cell  had  individuals  who  were  Spanish  residents,  shared 
common  ideas  and  beliefs  about  jihad  among  themselves  and  with  A1  Qaeda,  but  did  not 
formally  belong  to  the  “A1  Qaeda  organization”  (Haahr-Escolano,  2005).  None  of  the 
members  of  the  Madrid  terrorist  cell  had  been  trained  in  any  of  A1  Qaeda’s  training 
camps  in  Bosnia,  Afghanistan  and  elsewhere  (Benjamin  &  Simon,  2005).  The  network 
was  composed  of  “amateurs,”  since  the  members  of  the  terrorist  cell  had  neither  previous 
experience  nor  training  to  conduct  terrorist  acts  (Jordan  &  Wesley,  2006).  For  this  reason, 
the  Application  Experience  in  the  baseline  model  was  set  to  low  for  all  members.  The 
required  skill  levels  for  all  actors  were  also  set  to  low  for  the  reasons  mentioned  above, 
except  for  the  Architect  (Muhammad  the  Egyptian),  who  was  an  expert  in  bombs  and 
therefore  had  a  high  “weaponize”  skill. 

Since  the  Architect  was  the  only  member  of  the  group  who  had  knowledge  about 
bombs,  the  model  has  a  knowledge  link  that  starts  from  the  actors  who  assemble  the 
bombs  and  ends  at  the  Architect.  This  knowledge  link  indicates  the  path  that  actors  who 
encounter  exceptions  should  follow  in  order  to  reach  the  appropriate  actor  who  can 
manage  the  exceptions  that  are  generated  during  the  execution  of  the  actors’  task. 

The  level  of  task  uncertainty  indicates  the  amount  of  information  that  the  actor  is 
missing  as  he  goes  about  completing  a  task,  and  task  complexity  represents  the  relative 
difficulty  of  performing  a  specific  task.  For  the  Madrid  case  study,  the  levels  of 
uncertainty  and  complexity  are  set  to  medium  since  there  are  no  indicators  to  justify  a 


change  of  these  values  for  the  specific  attack. 
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The  coordination  links  (green  lines  among  tasks)  indicate  that,  in  order  to 
complete  a  specific  task,  actors  have  to  communicate  with  other  actors.  For  example,  the 
team  that  is  responsible  for  the  bombs  communicates  with  those  who  train  for  the  attack 
and  vice  versa.  The  rework  links  (red  lines),  on  the  other  hand,  are  unidirectional.  An 
exception  created  at  a  specific  task  might  generate  rework  for  another  task.  For  example, 
an  exception  created  during  the  financing  task  might  create  rework  at  the  planning  task, 
since  new  parameters  must  be  taken  into  account  for  the  successful  planning  of  the 
operation.  Each  rework  link  has  an  embedded  value  that  characterizes  the  rework 
strength.  Rework  strength  of  0. 1  implies  that  1  day  of  rework  in  the  source  task  will  cause 
0. 1  day  of  rework  in  the  target  task. 

The  level  of  centralization  indicates  which  organizational  level  has  the  decision¬ 
making  responsibility  within  the  organization.  A  low  level  of  centralization  suggests  that 
all  expect  decision  rights  remain  at  the  lowest  levels  of  the  organization.  Similarly,  a  high 
centralization  level  indicates  that  all  decisions  are  made  at  the  highest  levels  of  the 
organization.  The  centralization  of  the  Madrid  terrorist  network  is  set  to  low  because, 
even  though  the  network  had  a  leader  and  an  architect,  all  decisions  were  made  by  the 
actors  at  the  lowest  level  of  the  organization.  The  Madrid  terrorist  cell  was  a 
decentralized  network  that  acted  as  a  group  focused  on  the  completion  of  its  project,  the 
terrorist  attack. 

Formalization,  according  to  Organization  Theory,  is  based  on  the  degree  to  which 
work  structures  and  job  descriptions  are  rigidly  defined  within  the  organization.  The 
formalization  of  the  network  is  set  to  low  because  the  members  of  the  network  did  not 
have  predesigned  tasks  and  their  jobs  were  not  predetermined  from  the  planning  phase  of 
the  attack.  The  available  open  source  data  (academic  papers  and  news  articles)  provide 
the  opportunity  to  separate  the  network’s  activities  into  explicit  subtasks. 

Team  experience  is  the  experience  the  team  has  on  the  specific  type  of  project. 
Even  though  all  the  members  of  the  terrorist  group  had  the  same  beliefs,  shared  the  same 
ideas  and  had  friendship  or  family  ties,  they  had  never  perfonned  a  terrorist  attack 
together.  Therefore,  their  team  experience  is  set  to  low.  Matrix  strength  indicates  the 
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tendency  actors  have  toward  coordination  among  horizontal  lines.  In  the  Madrid  terrorist 
cell,  members  relied  completely  on  lateral  relations;  therefore,  the  matrix  strength  is  set 
to  high. 

The  communication  probability  of  0.6  indicates  that  60%  of  the  total  amount  of 
communications  are  successfully  performed  among  actors.  According  to  Kunz,  et  al. 
(1998),  noise  consumes  actors’  time  without  contributing  to  performance.  Therefore,  a 
noise  probability  of  0.2  indicates  that  20%  of  the  actors’  total  time  is  spent  on  things  that 
are  not  related  to  the  project.  The  parameters  Functional  Error  Probability  (FEP)  and 
Project  Error  Probability  (PEP)  address  two  different  aspects  of  environmental  difficulty. 
FEP  indicates  the  probability  of  organizations  making  errors  and  causing  exceptions  at 
the  functional  level,  and  PEP  indicates  the  probability  of  organizations  making  errors  and 
causing  exceptions  across  functions  that  affect  the  whole  project. 

The  organizational  levels  indicate  the  vertical  levels  that  exist  within  the 
organization.  For  example,  Edge  has  one  organizational  level,  Simple  Structure  and 
Professional  Bureaucracy  have  two,  and  Machine  Bureaucracy  has  three  or  more 
organizational  levels.  The  values  of  rework  strength,  communication  probability,  noise 
probability,  FEP  and  PEP  presented  in  Table  1  are  patterned  in  particular  after  relevant, 
previous  work  (Gateau  et  al.,  2007;  Nissen  &  Leweling,  2007)  and  the  interested  reader  is 
directed  to  this  previous  work  for  more  details. 

C.  THE  EXPERT  AND  HIERARCHY  MODELS 

Even  though  the  Baseline  model  does  not  capture  the  relations  among  the 
individual  members  of  the  group,  such  as  family,  occupational  or  friendship  relations,  it 
provides  the  opportunity  to  examine  the  structure  and  the  workflows  of  the  terrorist 
network  that  was  responsible  for  the  2004  Madrid  bombings.  It  allows  us  to  develop 
variations  of  this  model  in  order  to  answer  the  research  question  and  generate  suggestions 
about  ways  to  thwart  terrorist  groups.  Table  2  summarizes  the  variations  of  the  Baseline 
model. 
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Parameter 

Baseline  Model 
Values 

“Expert” 

Model 

Values 

“Hierarchy” 
Model  Values 

Skill  levels 

Low 

High 

Medium 

Application  Experience 

Low 

High 

Low 

Team  Experience 

Low 

High 

Medium 

Formalization 

Low 

Low 

High 

Centralization 

Low 

Low 

High 

Matrix  Strength 

High 

High 

Medium 

Communication  Probability 

0.60 

0.60 

0.30 

Noise  Probability 

0.20 

0.20 

0.10 

Functional  Exception  Probability 

0.15 

0.15 

0.05 

Project  Exception  Probability 

0.15 

0.15 

0.05 

Organizational  Levels 

1 

1 

3 

Table  2.  Model  Manipulation  Variables 


The  2004  Madrid  terrorist  cell  was  composed  of  “amateurs”  (Haahr-Escolano, 
2005)  with  low  skill  and  application  experience  levels.  The  threat  of  amateur  terrorists  is 
examined  in  comparison  with  an  “expert  model”  that  substitutes  experts  for  amateurs. 
The  “experts”  in  the  expert  model  have  high  skill  levels  that  match  the  tasks’  required 
skills;  for  example,  an  expert  on  weapons  is  performing  the  “weaponize”  task.  Their 
application  experience  also  is  high,  which  indicates  that  they  have  performed  the  tasks 
repeatedly  in  the  past.  The  team  experience  is  set  to  high,  indicating  that  the  expert  group 
had  performed  these  terrorist  tasks  in  the  past  as  a  team.  All  other  model  parameters  are 
the  same  as  in  the  Baseline  case. 
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Figure  4.  Madrid  Cell  Hierarchy  Model 

Despite  the  fact  that  many  terrorist  networks  are  decentralized  and  are  not 
branches  of  the  AQ  organization,  some  appear  to  be  locally  organized  as  a  hierarchy. 
Therefore,  a  hierarchical  model  is  introduced,  where  the  structure  of  the  network  is  a 
three-level  hierarchy.  Figure  4  illustrates  the  Hierarchical  model  of  the  Madrid  terrorist 
cell.  The  key  attributes  of  both  the  actors  and  the  tasks  are  the  same  as  the  baseline 
model.  The  total  work  performed  in  both  the  Baseline  and  the  Hierarchical  model  is 
identical.  The  leader  stands  at  the  top  of  the  hierarchy;  the  architect  and  the  cell 
commander  are  the  terrorist  organization’s  middle  managers.  The  financers,  weaponiers 
and  followers  operate  at  the  lowest  level  of  the  organization  and  are  subordinates  of  the 
cell  commander.  The  values  of  the  parameters  presented  in  Table  2  for  the  Hierarchical 
structure  are  patterned  after  previous  POW-ER  models  that  characterized  organizational 
hierarchies  (esp.  Looney  &  Nissen,  2006;  Gateau  et  ah,  2007). 
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D. 


THE  COUNTERTERRORIST  CONDITIONS 


The  three  models  introduced  above  are  tested  under  different  “counterterrorist 
conditions.”  In  general,  counterterrorist  actions  may  lead  to  the  destruction  of  a  terrorist 
cell  or  to  the  arrest  of  terrorists  that  prepare  a  terrorist  attack.  This  thesis  examines  the 
Madrid  terrorist  network,  which  was  a  “successful  terrorist  project”,  where  no  member 
was  captured  before  the  execution  of  the  attack.  Therefore,  in  this  thesis  counterterrorism 
conditions  are  composed  of  three  basic  elements.  The  first  is  the  noise  probability,  the 
second  is  the  level  of  task  uncertainty,  and  the  third  is  the  level  of  task  complexity.  The 
values  of  these  parameters  for  the  Baseline  case  were  analyzed  earlier  in  the  chapter. 


Baseline  Counterterrorist 
Conditions 

High  Counterterrorist 
Conditions 

Noise 

0.20  or  0.10  (Hierarchy) 

0.80  or  0.40  (Hierarchy) 

Task  uncertainty 

Medium 

High 

Task  complexity 

Medium 

High 

Table  3.  Baseline  and  High  Counterterrorist  Conditions 


High  counterterrorist  conditions  occur  when  counterterrorist  agencies  perform  a 
high  level  of  counterterrorist  acts  in  order  to  distract  terrorist  members  from  their  prior 
tasks.  Therefore,  the  noise  probability  is  greater  for  high  counterterrorist  conditions. 
According  to  Sterman  (2000),  extreme  input  values  give  the  opportunity  to  the  researcher 
to  observe  with  greater  clarity  and  confidence  the  differences  that  occur  at  the  outputs. 
Therefore,  the  noise  probability  value  for  the  high  counterterrorist  conditions  is  set  four 
times  greater  than  the  noise  probability  of  the  Baseline  case.  High  counterterrorist 
conditions  also  imply  that  the  terrorists  will  perfonn  their  tasks  with  greater  uncertainty 
(have  less  information  to  complete  the  task)  and  the  task  itself  will  become  more  difficult 
(high  task  complexity).  This  manipulation  aims  to  explore  the  effect  that  intense 
counterterrorist  acts  have  on  terrorist  networks  while  they  are  planning  to  execute  a 
terrorist  act.  Table  3  summarizes  the  differentiating  variables  under  the  two 
counterterrorist  conditions. 
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Baseline  Model 
(Low  Expertise) 

Expert  Model 

Hierarchical 

Model 

Baseline 

Counterterrorist 

Conditions 

High 

Counterterrorist 

Conditions 

Table  4.  The  3x2  factorial  research  design 


To  summarize,  this  thesis  examines  three  different  terrorist  organizations  under 
two  different  counterterrorist  conditions,  in  order  to  provide  insights  about  the  network’s 
underlying  structure.  In  design  terms,  it  is  a  3  x  2  factorial  design  with  three  different 
representations  of  a  specific  terrorist  group  (i.e.,  the  Baseline,  the  Expert  and  the 
Hierarchical  model),  under  two  different  mission-environmental  contexts  (i.e.,  Baseline 
and  High  counterterrorist  conditions).  The  results  of  these  comparisons  are  presented 
analytically  in  Chapter  V. 
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V.  RESULTS 


This  chapter  examines  the  simulation  results  of  the  various  model  manipulations 
presented  in  Chapter  IV.  Initially,  a  comparison  is  made  between  the  Baseline  model, 
which  is  composed  of  low  skilled  and  inexperienced  members,  and  the  Expert  model 
(EX),  which  is  a  representation  of  the  baseline  model  with  highly  skilled  and  experienced 
members.  Then  the  Baseline  model  is  compared  with  the  Hierarchical  model.  All 
comparisons  presented  are  also  tested  under  two  different  environmental  conditions,  the 
baseline  (BCC)  and  high  counterterrorist  (HCC)  conditions,  in  order  to  examine  how 
different  environmental  conditions  affect  the  models  mentioned  above.  Finally,  all 
models  are  compared  holistically  under  the  two  different  environmental  conditions. 

The  simulation  results  for  all  models  are  summarized  in  Table  5.  We  first 
compare  the  Baseline,  the  Expert  and  the  Hierarchical  model  under  baseline 
counterterrorist  conditions  then  compare  the  same  models  under  high  counterterrorist 
conditions.  The  differentiations  of  the  models’  variables  are  described  in  detail  in  Chapter 
IV.  The  values  in  bold  of  Table  5  indicate  the  lowest  value  for  each  variable  in  the  two 
different  counterterrorist  conditions. 
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Baseline  Counterterrorist  Conditions 
(BCC) 

High  Counterterrorist  Conditions 
(HCC) 

Scenarios 

Parameters 

Baseline 

Expert  (EX) 

Hierarchy 

Baseline 

Expert  (EX) 

Hierarchy 

Duration 

(days) 

404 

197 

425 

408 

198 

458 

Rework 

(person-days) 

65 

94 

82 

69 

96 

102 

Coordination 

(person-days) 

222 

256 

42 

255 

317 

68 

Wait  Time 
(person-days) 

26 

4 

61 

23 

3 

84 

Communication 

Risk 

(probability) 

0.61 

0.55 

0.60 

0.61 

0.56 

0.56 

Functional 

Risk 

(probability) 

0.75 

0.20 

0.75 

0.75 

0.20 

0.73 

Project  Risk 
(probability) 

0.71 

0.71 

0.56 

0.72 

0.71 

0.55 

Table  5.  Simulation  Performance  Results 


A.  BASELINE  COUNTERTERRORIST  CONDITIONS’  MODEL 

COMPARISON 

Beginning  with  the  results  of  the  Baseline  model  under  Baseline  Counterterrorist 
Conditions  (BCC),  that  are  reported  in  the  second  column  of  Table  5,  the  terrorist 
organization  accomplishes  its  tasks  in  404  days;  this  is  a  measure  of  organizational  speed 
which  is  very  important  for  perfonning  a  terrorist  attack  under  time  constraints.  (The 
2004  Madrid  attack  had  to  be  performed  some  days  before  the  Spanish  general  elections 
in  order  to  create  a  greater  impact  (Wright  2004)). 

For  reference,  although  the  exact  duration  of  this  “terrorist  project”  remains 
unknown,  certain  informed  estimates  vary  from  four  months  (a  Spanish  official  suggested 
that  the  cell  started  the  planning  of  the  attack  the  day  after  the  release  of  bin  Laden’s 
messages  at  the  end  of  October  2003  encouraging  terrorists  to  attack  Spain  (Benjamin  & 
Simon,  2005))  to  thirty  months  (a  terrorist  claimed,  “This  plan  cost  me  a  lot  of  study  and 
patience.  It  took  me  two  and  a  half  years”  (Sciolino  &  Horowitz,  2004)).  The  simulation 
result  of  404  days  (i.e.,  roughly  14  months)  is  close  to  the  mean  of  these  estimates. 
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Continuing  with  Baseline  results  in  the  table,  the  level  of  rework  (65  person-days) 
reflects  the  level  of  effort  expended  attending  to  exceptions  and  correcting  errors  that  are 
made  during  the  “terrorist  project.”  Coordination  (222  person-days)  reflects  the  level  of 
effort  expended  for  coordination  between  the  various  actors  of  the  terrorist  network.  The 
26  person-days  of  wait  time  reflect  the  amount  of  time  that  actors  spent  waiting  for 
decisions  to  be  made  and  information  to  be  provided. 

The  communication  risk  of  0.61  indicates  that  61%  of  the  total  communications’ 
volume  that  occurs  among  actors  is  likely  to  be  ignored  or  addressed  inadequately. 
Functional  risk  of  0.75  indicates  that,  on  average,  75%  of  the  exceptions  that  are  created 
for  a  particular  functional  area  (for  example  the  planning  task)  are  inadequately  reworked 
or  ignored  by  the  actors.  Finally,  project  risk  of  0.71  indicates  that,  on  average,  71%  of 
the  exceptions  that  are  created  across  functional  areas  are  ignored  or  inadequately 
resolved  by  the  actors  of  the  organization.  According  to  Ramsey  and  Levitt  (2005), 
project  exceptions  are  related  to  the  interface  issues  of  the  functional  and  knowledge 
areas  of  the  project. 

For  comparison,  the  Expert  model  requires  only  197  days  to  accomplish  the 
terrorist  tasks.  This  is  less  than  half  of  the  time  duration  required  in  the  Baseline  model; 
therefore,  the  expert  organization  moves  much  faster  than  the  Baseline.  The  Expert  model 
also  involves  more  rework  (94  person-days).  This  is  almost  50%  more  in  comparison 
with  the  Baseline  model  and  indicates  that  a  greater  number  of  exceptions  and  errors  are 
corrected  by  the  Expert  organization.  Coordination  (256  person-days)  is  greater  for  the 
Expert  organization  also,  since  the  organization’s  actors  need  to  coordinate  more  in  order 
to  rework  more  exceptions.  Wait  time  in  the  Expert  organization  is  4;  this  is  almost  one 
sixth  of  the  wait  time  for  the  Baseline  organization.  This  occurs  because  actors  that  are 
connected  with  knowledge  links  in  the  expert  organization  do  not  have  to  wait  long  for 
experts  to  provide  them  with  information,  since  they  are  experts  themselves  and  the 
exceptions  that  are  handled  through  the  knowledge  links  are  few. 

The  communication  risk  is  lower  for  the  Expert  organization  (0.55)  since  the  team 

experience  is  high  in  comparison  to  the  low  team  experience  of  the  Baseline  organization. 

The  large  number  of  reworked  exceptions  also  is  reflected  in  the  functional  risk  of  the 
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Expert  organization  (0.20)  which  is  almost  one  quarter  of  Baseline’s  functional  risk. 
Finally,  project  risk  level  (0.71)  is  approximately  the  same  as  the  Baseline  organization. 
Hence,  even  though  the  Expert  model  entails  almost  the  same  risk  as  the  Baseline 
organization,  it  is  faster  than  the  Baseline  model. 

For  comparison  with  the  Baseline,  the  Hierarchy  requires  roughly  21  days  more 
time  to  accomplish  its  terrorist  attack  tasks  and  hence  moves  somewhat  more  slowly. 
This  is  consistent  with  results  in  other  contexts  (e.g.,  joint  task  force,  see  Gateau  et  ah, 
2007;  coalition  mission  planning,  see  Looney  and  Nissen,  2006;  Computer  Network 
Defense,  see  Koons  et  ah,  2008).  In  comparison  to  both  the  Baseline  and  the  Expert 
models,  the  Hierarchy  is  the  slowest  of  all.  The  Hierarchy  involves  a  greater  level  of 
rework  (82  person-days)  in  comparison  to  the  Baseline  model,  which  indicates  that  a 
greater  number  of  exceptions  and  errors  are  corrected  by  the  Hierarchical  organization 
than  the  ones  reworked  by  the  Baseline  organization.  On  the  other  hand,  the  Hierarchy 
requires  less  rework  in  comparison  to  the  Expert  model.  Coordination  (42  person-days)  is 
considerably  less  for  the  Hierarchy  than  for  either  the  Baseline  or  Expert  models,  as 
actors  without  a  hierarchical  organization  are  required  to  coordinate  abundantly  and 
laterally.  However,  wait  time  (61  person-days)  is  almost  two  and  a  half  times  greater  in 
comparison  to  the  Baseline  and  fifteen  times  more  in  comparison  to  the  Expert  model,  as 
actors  in  the  Baseline  and  the  Expert  models  do  not  have  to  wait  for  supervisors  to  make 
decisions  or  provide  information. 

The  communication  and  functional  risks  are  comparable  for  both  the  Baseline  and 
Hierarchy  (0.61  vs.  0.60),  indicating  the  immunity  of  these  variables  to  structural  change. 
As  with  the  Baseline,  however,  the  functional  risk  of  the  Hierarchy  (0.75)  is  much  greater 
in  comparison  to  the  Expert  model  (0.20),  since  more  exceptions  are  reworked  in  the 
Expert  model.  Finally,  project  risk  level  (0.56)  is  appreciably  lower  for  the  Hierarchy. 
Hence,  the  Hierarchy  entails  less  project  risk  in  comparison  to  the  other  two  models 
(Baseline  and  Expert  models). 

Therefore,  there  is  a  set  of  strengths  and  weaknesses  that  characterize  these 

models  under  BCC;  these  are  summarized  here.  First,  the  Baseline  model  requires  the 

least  rework  in  comparison  with  the  other  two  models.  Moreover,  the  Baseline  model  is 
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faster  and  requires  less  wait  time  in  comparison  with  the  Hierarchical  model.  The 
Baseline  model  also  requires  less  coordination  in  comparison  with  the  Expert  model.  The 
weaknesses  of  the  Baseline  model  are  its  high  communication,  functional  and  project 
risks.  Second,  the  Expert  model  has  the  smallest  project  duration,  wait  time,  and 
communication  and  functional  risks  in  comparison  to  the  Baseline  and  the  Hierarchical 
models.  The  weaknesses  of  the  Expert  model  are  the  high  levels  of  required  rework, 
coordination  and  project  risk.  Third,  the  Hierarchy  requires  the  least  coordination  and  has 
the  lowest  level  of  project  risk  in  comparison  with  the  Baseline  and  the  Expert  model.  In 
addition,  the  Hierarchy  requires  less  rework  in  comparison  to  the  Expert  model.  The 
Hierarchy’s  weaknesses  are  the  project’s  duration,  wait  time,  and  communication  and 
functional  risks. 

Hence,  there  is  a  set  of  tradeoffs  that  characterize  these  organization  forms:  to  the 
extent  that  organizational  speed  is  important.  The  Expert  model  appears  to  have  an  edge 
over  the  other  two  models,  but  to  the  extent  that  project  risk  represents  a  primary 
concern,  the  Hierarchy  represents  the  sharper  organization. 
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Figure  5.  Project  Duration,  Risk  and  Required  Coordination  Comparison  of  the 
Models  Under  BCC 
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To  illustrate  this  comparison  it  would  be  beneficial  to  take  into  account  a  key 
attribute  of  terrorist  networks:  the  maintenance  of  a  high  secrecy  level  during  the 
preparation  and  execution  of  an  attack.  When  the  actors,  in  order  to  accomplish  a  project, 
have  to  coordinate  regularly,  the  secrecy  of  the  project  is  put  at  risk.  Therefore,  in 
addition  to  the  speed  and  project  risk,  coordination  levels  are  of  primary  importance 
when  examining  terrorist  groups.  Figure  5  summarizes  the  project’s  risk,  duration  and 
coordination  levels  under  BCC.  The  total  amount  of  coordination  required  for  each  model 
is  represented  by  the  size  of  each  circle,  which  has  the  exact  coordination  value  (in 
person-days)  next  to  it.  Hence,  a  terrorist  group  that  is  risk  averse  and  wants  to  maintain 
high  level  of  secrecy  (low  coordination  level)  is  more  likely  to  have  a  hierarchical 
structure,  and  a  group  that  has  limited  time  to  perform  a  task,  and  risk  or  required 
coordination  is  not  of  main  concern,  is  more  likely  to  have  a  decentralized  form  (Expert 
or  Baseline,  depending  on  the  members’  skill  level). 

B.  HIGH  COUNTERTERRORIST  CONDITIONS’  MODEL  COMPARISON 

When  the  Baseline,  the  Expert  and  the  Hierarchical  organizations  are  tested  under 
high  counterterrorist  conditions  (i.e.,  high  levels  of  noise,  task  uncertainty  and  task 
complexity)  the  outcomes  are  the  following.  First,  in  the  Baseline  model  under  high 
counterterrorist  conditions  (HCC)  the  total  project  duration  increases  by  4  days  (to  408 
days),  and  the  project  duration  of  the  Expert  model  remains  almost  the  same  (198  vs.  197 
days).  Moreover,  the  project  duration  for  the  Hierarchical  model  increases  by  33  days  (to 
458  days)  in  comparison  with  the  BCC.  This  differentiation  between  the  two 
environments  is  affected  by  the  different  skill  and  application  experience  levels  among 
the  models,  and  the  degree  of  change  is  a  result  of  the  model’s  structure.  The  Baseline 
and  the  Hierarchical  models’  actors  have  low  skill  and  application  experience  levels  and 
the  Expert  model’s  actors  have  high  skill  and  experience  levels.  Tasks  with  great 
uncertainty  and  complexity  under  an  environment  with  greater  noise  levels  “slow  down” 
amateur  actors  but  have  almost  no  effect,  in  terms  of  project  duration,  on  expert  actors. 
The  total  amount  of  rework  is  slightly  greater  for  the  Baseline  (increase  of  four  person- 
days)  and  the  Expert  (increase  of  two  person-days)  model  and  even  greater  for  the 
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Hierarchical  model  (increase  of  20  person-days)  under  HCC  in  comparison  to  BCC.  The 
coordination  is  greater,  in  comparison  with  the  BCC,  for  the  Baseline  (255  person-days), 
the  Hierarchical  (68  person-days)  and  the  Expert  (317  person-days)  model.  The  wait  time 
decreases  slightly  for  both  the  Baseline  (23  days)  and  Expert  (three  days)  models  but 
increases  for  the  Hierarchy  (84  days)  model  under  HCC.  The  communication  risk 
remains  almost  at  the  same  levels  for  both  the  Baseline  (0.61)  and  the  Expert  (0.56  vs. 
0.55)  models  and  slightly  decreases  for  the  Hierarchical  (0.56)  model  under  HCC.  The 
functional  and  project  risks  remain  almost  the  same  for  all  three  models  under  both 
counterterrorist  conditions,  indicating  that  extensive  counterterrorist  acts  do  not  affect 
these  variables.  So  all  models  (Baseline,  Expert  and  Hierarchical  models)  outperform 
under  BCC  in  terms  of  speed  and  required  amounts  of  rework  and  coordination. 

Therefore,  there  is  a  set  of  strengths  and  weaknesses  that  characterize  these 
models  under  HCC.  First,  the  Baseline  model  requires  the  smallest  amount  of  rework  in 
comparison  with  the  other  two  models.  Moreover,  the  Baseline  model  is  faster  and 
requires  less  wait  time  in  comparison  with  the  Hierarchical  model.  The  weaknesses  of  the 
Baseline  model  are  its  high  coordination  level  and  its  high  communication,  functional 
and  project  risk.  Second,  the  Expert  model  has  the  smallest  project  duration,  wait  time, 
and  communication  and  functional  risks  in  comparison  to  the  Baseline  and  the 
Hierarchical  models.  In  addition,  the  Expert  model  requires  less  rework  in  comparison  to 
the  Hierarchy  model.  The  weaknesses  of  the  Expert  model  are  the  high  levels  of  the 
required  coordination  and  project  risk.  Third,  the  Hierarchy’s  strengths  are  the  small 
amount  of  coordination  and  the  low  levels  of  communication  and  project  risks  in 
comparison  with  the  Baseline  and  the  Expert  models.  The  Hierarchy’s  weaknesses  are  the 
project’s  duration,  required  rework,  wait  time  and  functional  risk. 

The  results  suggest  that  agencies  that  increase  the  counterterrorist  activity 
(increased  number  of  suspects’  arrests  and  investigation  of  suspicious  locations  that  may 
be  used  as  meeting  places  for  terrorists)  do  not  increase  the  project  risk  involved  in  a 
terrorist  project  for  both  expert  (Expert  model)  and  amateur  terrorist  groups  (Baseline  and 
Hierarchical  models).  Moreover,  high  counterterrorist  conditions  delay  the  terrorist 
network’s  activities  (Baseline,  Expert  and  Hierarchical  models)  but  the  level  of  delay 
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depends  on  the  terrorist  group’s  structure  and  members’  skill  and  application  levels.  HCC 
increase  the  Expert  group’s  project  duration  by  one  day  (almost  0.5%)  and  the  amateur 
group’s  (Baseline  model)  project  duration  by  four  days  (almost  1%).  Therefore,  higher 
counterterrorist  conditions  have  almost  no  effect  on  the  speed  of  decentralized  groups. 
The  hierarchy’s  project  duration  increases  by  33  days  (an  almost  8%  increase).  Moreover, 
high  counterterrorist  conditions  have  little  effect  on  the  speed  of  a  hierarchical  group.  In 
addition,  HCC  increase  the  required  amount  of  coordination  by  almost  15%  for  the 
Baseline  model,  24%  for  the  Expert  model  and  62%  for  the  Hierarchical  model.  Hence, 
the  secrecy  level  of  hierarchical  terrorist  groups  is  greatly  decreased  when  the  group 
operates  under  HCC.  Figure  6  summarizes  the  comparison  of  the  three  models 
(Baseline,  Expert  and  Hierarchy)  in  terms  of  speed,  project  duration  and  required 
coordination.  The  required  coordination  is  represented  by  the  size  of  each  circle,  which 
has  the  exact  coordination  value  next  to  it. 
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Figure  6.  Project  Duration,  Risk  and  Required  Coordination  Comparison  of  the 
Models  Under  HCC 


C.  MODEL  COMPARISON  UNDER  BOTH  COUNTERTERRORIST 
CONDITIONS 

Figure  7  illustrates  the  three  models  (Baseline,  Expert  and  Hierarchy)  under  two 


counterterrorist  conditions  in  terms  of  speed  and  risk.  The  Expert  model  is  the  fastest  of 
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all  models  under  both  counterterrorist  conditions,  and  the  Hierarchy  under  both 
counterterrorist  conditions  (0.56  for  BCC  and  0.55  for  HCC)  has  the  lowest  level  of 
project  risk. 


Project  Duration 


♦  Baseline  BCC  Expert  BCC  *  Hierarchy  BCC 
■  Baseline  HCC  Expert  HCC  •  Hierarchy  HCC 


Figure  7.  Project  Duration  and  Risk  Comparison  Under  Both  Counterterrorist 
Conditions 

To  summarize,  counterterrorist  agencies  should  take  into  consideration  the 
comparison  of  these  three  different  terrorist  configurations  in  order  to  understand  their 
attributes  and  behavior  under  the  two  different  counterterrorist  environments.  The 
organizational  structure  with  greater  speed  is  the  decentralized  terrorist  network 
composed  of  experts,  but  when  either  the  secrecy  level  or  the  project’s  risk  is  of  main 
concern,  the  terrorist  network  with  a  hierarchical  structure  has  an  edge  over  the  other  two 
decentralized  models.  Therefore,  counterterrorist  agencies  should  focus  primarily  on 
decentralized  terrorist  networks  (especially  the  ones  composed  of  experts)  when  there  are 
indications  that  a  “terrorist  attack  project”  might  be  planned  and  executed  under  tight 
time  constraints.  In  addition,  when  time  is  not  of  primary  concern  for  terrorist  groups,  but 
the  maintenance  of  low  levels  of  risk  and  coordination  are,  the  hierarchical  configuration 
of  terrorist  networks  should  be  first  examined  by  counterterrorist  agencies. 
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When  both  secrecy  and  risk  are  of  main  concern  to  terrorists,  and  the  terrorist 
group  has  a  decentralized  structure  (based  on  infonnation  from  intelligence  sources),  the 
terrorist  groups  composed  of  amateurs  have  an  edge  over  a  group  composed  of  experts. 
Therefore,  counterterrorist  agencies  should  focus  also  on  “amateur”  groups  because,  even 
though  the  members  of  these  groups  lack  skill  and  experience,  they  have  shown  in  the 
past  that  they  are  capable  of  performing  terrorist  attacks  (i.e.,  the  2004  Madrid  train 
bombings). 

Counterterrorist  agencies  should  also  take  into  consideration  the  fact  that,  in 
general,  high  counterterrorist  conditions  do  not  affect  the  project  risk  levels  of  the 
terrorist’s  project.  In  addition,  under  HCC,  the  required  coordination  among  the  members 
of  decentralized  terrorist  networks  (in  both  Baseline  and  Expert  models)  increases.  In 
addition,  the  required  level  of  coordination  among  hierarchical  members  increases 
significantly.  Therefore,  extensive  counterterrorist  conditions  affect  the  secrecy  level  of 
all  groups  and  especially  of  hierarchical  configured  networks.  Moreover,  the  project 
duration  of  the  hierarchical  network  increases  by  almost  8%.  The  Expert  model’s  project 
duration  remains  almost  the  same  and  the  Baseline’s  project  duration  increases  almost  by 
1%  within  HCC  in  comparison  with  BCC.  Thus,  HCC  affect  the  speed  of  hierarchical 
networks  more  than  it  affects  the  speed  of  decentralized  networks.  Hence,  groups 
configured  hierarchically  are  more  “sensitive”  to  high  counterterrorist  conditions  in 
comparison  to  decentralized  terrorist  networks.  The  conclusions,  limitations  and  future 
research  opportunities  of  this  thesis  are  presented  in  Chapter  VI. 
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VI.  CONCLUSIONS 


The  understanding  of  terrorist  networks  is  of  main  concern  for  governments, 
especially  in  the  last  decade,  since  major  terrorist  attacks,  such  as  9/11,  the  2004  Madrid 
attack  and  the  2005  London  attack,  have  changed  people’s  view  of  security  on  their  own 
soil.  By  implementing  counterterrorist  policies,  governments  try  to  safeguard  their  people 
and  interests  and  thwart  the  terrorist  cells  that  put  them  in  danger. 

Terrorism  is  a  not  a  form  of  conventional  warfare  between  states  (e.g.,  World  War 
II,  Cold  War)  but  a  war  between  states  and  networks.  Terrorism  is  not  a  regional 
phenomenon  but  a  threat  that  exists  at  a  global  level  (Robb,  2006).  Terrorism  is  a 
network  of  networks  that  operates  in  a  decentralized  manner  (Magouirk,  et  al.,  2008). 
Bell  (2002)  suggests  that  thwarting  terrorism  requires  a  policy  focusing  on  the  fact  that 
terrorism  relies  on  commitment,  so  “loss  of  faith,  the  imposition  of  reality,  and  changing 
times  can  erode  its  strength.”  Brafman  and  Beckstrom  (2006)  similarly  suggest  that 
decentralized  networks  can  be  disrupted  if  their  members  lose  the  motivation  that  was  the 
driving  factor  for  them  to  join  the  network  in  the  first  place.  On  the  other  hand,  terrorist 
networks  are  composed  of  individuals  who  can  not  be  easily  identified  by  the 
counterterrorist  agencies,  and  this  makes  Bell’s  recommendation  even  more  time 
consuming.  Therefore,  in  order  to  analyze  terrorist  groups,  counterterrorist  agencies  use 
various  methods  that  help  them  understand  terrorist  groups  in  the  short  term,  such  as 
Social  Network  Analysis  (SNA). 

One  of  the  uses  of  SNA  methodology  is  to  understand  the  relationships  within 
terrorist  networks  (Hassan,  2007;  Mccartan  et  al.,  2008;  Magouirk  et  al.,  2008;  Jordan  et 
al.,  2008).  SNA  is  based  on  Network  theory  and  examines  the  connections  and 
interactions  among  individuals  or  groups  based  on  common  patterns  of  friendship, 
occupation,  ethnicity,  or  any  other  pattern  that  is  of  interest  to  the  researcher  (Newman, 
2003).  The  limitation  of  this  approach  is  that  it  does  not  examine  the  structure  and  the 
workflow  of  the  network  for  a  specific  activity  (e.g.,  a  bombing  attack)  and  the  types  of 
interdependencies  (sequential,  reciprocal  or  pooled)  that  exist  among  the  tasks.  In 
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addition,  it  requires  the  identification  of  the  individuals  that  compose  a  terrorist  network, 
a  task  that  is  almost  impossible  to  be  performed  before  a  terrorist  attack  or  another 
incident. 

Conceptual  Simulation  Models,  using  Agent  Based  Modeling,  have  been  used  to 
represent  terrorist  networks  as  business  process  and  provide  insights  to  counterterrorism 
policy  makers  (Leweling  and  Nissen,  2007).  These  computer-based  models  analyze 
terrorist  networks  primarily  through  the  lens  of  contingency  theory.  This  thesis  examines 
the  structure  and  the  attributes  of  the  terrorist  network  that  was  responsible  for  the  2004 
Madrid  bombing  attack.  It  uses  Agent  Based  Modeling  to  analyze  the  roles,  activities  and 
interdependencies  of  tasks  and  actors  within  the  network,  something  that  is  not  feasible 
through  the  use  of  Social  Network  Analysis.  This  approach  generates  new  insights 
regarding  the  interdependencies  of  tasks  related  to  a  bombing  attack,  and  examines  how 
such  a  “project”  could  be  slowed  down  if  not  disrupted. 

The  research  design  initially  captures  the  Baseline  model,  which  is  an  abstraction 
based  on  real  world  data  from  academic  papers  and  news  articles  about  the  terrorist  cell 
that  performed  the  2004  Madrid  attack.  The  Baseline  model  is  compared  with  SNA 
networks  that  represent  the  2004  Madrid  terrorist  group,  indicating  the  common  general 
attributes  that  are  derived  from  both  models.  The  Baseline  model  represents  a  network  of 
“amateurs,”  since  its  members  had  no  previous  experience  with  terrorist  acts  or  any  clear 
ties  with  the  A1  Qaeda  network  (Jordan  and  Wesley,  2006). 

Then  the  Baseline  model  is  compared  with  the  Expert  model,  which  is  a 
representation  of  the  Baseline  model  with  highly  trained  and  experienced  members,  and 
the  Hierarchical  model,  which  is  a  representation  of  the  Baseline  model  with  a 
hierarchical  structure.  This  comparison  is  made  to  examine  how  different  contingency 
factors  affect  the  preparation  and  execution  of  a  terrorist  bombing  attack.  All  models  and 
comparisons  are  further  examined  under  high  counterterrorist  conditions  in  order  to  test 
the  networks’  resilience  when  counterterrorist  agencies  increase  the  intensity  of  suspect 
arrests,  investigations  and  surveillance. 
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All  cases  are  simulated  using  POW-ER  v.3.5b  software,  which  is  an  Agent  Based 
Model.  The  comparative  results  from  the  various  tests  mentioned  above  elucidate 
important  insights  into  terrorist  networks,  suitable  for  advice  to  counterterrorist  policy 
makers.  Initially,  terrorist  organizations  face  a  set  of  tradeoffs:  to  the  extent  that  speed  is 
of  main  concern,  the  decentralized  terrorist  network  composed  of  experts  represents  the 
sharpest  organizational  form,  but  when  either  project  risk  or  the  required  amount  of 
coordination  is  of  main  concern,  the  terrorist  network  with  a  hierarchical  structure  has  an 
edge  over  the  other  two  decentralized  structures.  Therefore,  counterterrorist  agencies 
should  take  into  consideration  that,  when  time  is  not  of  main  concern  to  terrorist 
organizations,  hierarchical  terrorist  networks  are  able  to  perfonn  an  attack  with  the 
lowest  level  of  project  risk,  maintaining  at  the  same  time  the  highest  levels  of  secrecy.  On 
the  other  hand,  when  it  is  known  that  terrorist  networks  are  planning  to  perfonn  an  attack 
under  time  pressure,  decentralized  terrorist  networks  should  be  regarded  as  a  primary 
threat.  Hence,  counterterrorist  agencies,  based  on  their  intelligence  sources  about  the 
terrorists’  view  of  time,  secrecy  and  project  risk,  could  derive  the  possible  structure  of  a 
terrorist  network  and  conduct  counterterrorist  acts  accordingly. 

Moreover,  high  counterterrorist  conditions  do  not  affect  the  project  risk  of  the 
terrorist’s  project.  This  applies  to  both  hierarchical  and  decentralized  terrorist  networks. 
Hence,  counterterrorist  agencies  should  consider  this  limitation  when  they  plan 
counterterrorist  acts  and  consider  it  when  they  perform  a  cost  benefit  analysis  for  their 
counterterrorist  policies. 

In  addition,  extensive  counterterrorist  environments  affect  the  secrecy  level  of  all 
groups  and  especially  of  hierarchical  configured  networks.  When  agencies  conduct 
extensive  counterterrorist  acts,  the  terrorists’  secrecy  level  decreases.  Even  though  HCC 
have  no  effect  on  project  risk,  they  increase  the  required  coordination  among  terrorists. 
This  is  an  additional  finding  that  counterterrorist  agencies  should  take  into  consideration. 

The  project’s  duration  of  the  hierarchical  network  also  increases  under  HCC.  The 
Expert  model’s  speed  remains  almost  the  same  and  the  Baseline’s  speed  increases 
slightly  within  HCC  in  comparison  with  BCC.  Hence,  groups  configured  hierarchically 
are  more  “sensitive”  to  high  counterterrorist  conditions  in  comparison  to  decentralized 
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terrorist  networks.  Agencies  should  perforin  counterterrorist  acts  extensively  when  they 
face  hierarchical  terrorist  groups  since  these  actions  decrease  the  network’s  speed  and 
secrecy  level.  Counterterrorist  agencies  should  have  in  mind  that  HCC  have  almost  no 
effect  on  the  decentralized  terrorist  network’s  speed  and  project  risk  but  increase  the 
required  amount  of  coordination;  therefore  decrease  the  project’s  secrecy  level. 

In  addition,  decentralized  (Edge-like)  terrorist  organizations  face  a  set  of 
tradeoffs:  to  the  extent  that  organizational  speed  is  important,  a  group  composed  of 
experts  has  an  edge  over  a  group  of  amateurs,  but  to  the  extent  that  risk  represents  a 
primary  concern,  both  organizations  appear  appropriate.  When,  in  addition  to  risk,  the 
“project’s”  secrecy  is  of  main  concern,  decentralized  terrorist  groups  composed  of 
amateurs  have  an  edge  over  a  decentralized  terrorist  group  of  experts.  Therefore, 
counterterrorist  agencies  should  focus  also  on  “amateurs”  because  these  groups  may 
perform  large-scale  terrorist  attacks  (i.e.,  the  2004  Madrid  train  bombings). 

This  thesis  has  limitations  that  should  be  taken  into  consideration  and  delimit  the 
generalization  of  this  thesis.  First,  the  Baseline  model  is  an  abstraction  of  the  2004 
Madrid  terrorist  group.  The  Baseline  model  contains  the  key  elements  that  are  necessary 
for  this  study,  excluding  others  that  are  of  no  central  interest  (Simon,  1996).  Therefore, 
this  model  is  not  an  exact  imitation  of  reality,  but  rather  an  abstraction  that  focuses  on 
specific  areas  of  interest.  Second,  the  results  of  this  study  are  derived  from  the 
examination  of  a  unique  case  study,  the  2004  Madrid  bombing  attacks.  According  to  Yin 
(2002)  a  cross  examination  of  at  least  three  case  studies  is  necessary  for  theory 
development,  followed  by  two  more  relative  case  studies  for  the  validation  of  the  derived 
theory.  Therefore,  the  results  from  this  case  study  should  be  compared  with  other  similar 
studies  in  order  to  generalize  counterterrorist  suggestions  and  propositions.  Third,  in  this 
thesis  counterterrorist  conditions  are  defined  in  terms  of  noise,  task  uncertainty  and  task 
complexity.  Moreover,  this  thesis  examines  the  2004  Madrid  bombings,  which  was  a 
“successful”  terrorist  project,  where  no  member  of  the  group  that  is  responsible  for  these 
attacks  was  captured  before  the  attacks.  Therefore,  this  thesis  does  not  examine  the 
underlying  structure  of  a  terrorist  network  that  failed  to  perform  an  attack  because  of 
counterterrorist  actions.  Future  research  on  “unsuccessful”  terrorist  attacks  and  the  cross 
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comparison  with  “successful”  ones  would  broaden  our  understanding  of  terrorist 
networks  and  the  effect  that  counterterrorist  acts  have  on  them.  Finally,  the  method  of 
“backcasting”  used  in  this  study  suggests  that  senior  managers  of  the  organization  under 
study  should  inform  the  researchers  whether  or  not  their  simulation  outcomes  are  similar 
to  those  observed  in  reality.  In  this  thesis,  this  was  not  possible  since  most  of  the 
members  of  the  2004  Madrid  terrorist  group  have  either  died  or  are  isolated  in  high 
security  prisons.  Instead,  Social  Network  Analysis  papers,  along  with  newspaper  articles 
and  books  that  focused  on  the  2004  Madrid  attack,  were  used  to  compare  the  Baseline 
model  with  the  SNA  models. 

Using  this  thesis  as  a  baseline,  future  research  could  examine  terrorist  networks 
that  were  responsible  for  other  attacks,  such  as  9/11,  the  2003  Bali  attacks,  and  the  2005 
London  attacks.  Such  additional  case  studies  can  generate  data  and  propositions  that 
could  be  cross  compared  for  the  generation  of  more  generally  applicable  counterterrorist 
propositions.  Moreover,  a  similar  approach  could  be  used  for  the  examination  and 
analysis  of  other  events  that  are  performed  by  small  groups,  teams  or  even  nations,  taking 
into  account  that  the  researcher  should  be  in  a  position  to  represent  these  groups  in  an 
organizational  form  perfonning  specific  tasks. 
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